Ignore empty "$_POST" values in MySQL queries - php

Question

I have three select box menus:
<select name="category" id="category" class="form-control" size="5">
<option value="">Delete</option>
<option value="0">Option 0</option>
<option value="1">Option 1</option>
</select>
<select name="category2" id="category2" class="form-control" size="5">
<option value="">Delete</option>
<option value="0">Option 0</option>
<option value="1">Option 1</option>
</select>
<select name="category3" id="category3" class="form-control" size="5">
<option value="">Delete</option>
<option value="0">Option 0</option>
<option value="1">Option 1</option>
</select>
The selected options are sent with ajax to a server sided script. Here I catch the selected options and use them in MySQL queries:
$query = "
SELECT * FROM itemSparse
INNER JOIN item
ON item.id = itemSparse.id
LEFT JOIN itemsubtest
ON itemsubtest.subclass = item.Material
INNER JOIN itemModifiedAppearance
ON itemModifiedAppearance.ItemID = itemSparse.id
INNER JOIN ItemAppearance
ON ItemAppearance.identifier = itemModifiedAppearance.ItemAppearanceID
INNER JOIN manifestInterfaceData
ON manifestInterfaceData.ID = ItemAppearance.DefaultIconFileDataID
WHERE 1=1
";
$query.= " WHERE item.ClassID = 4 ";
if(isset($_POST["is_category"]))
{
$query .= " AND item.Material = '".$_POST["is_category"]."'";
}
if(isset($_POST["is_category2"]))
{
$query .= " AND itemSparse.OverallQualityID = '".$_POST["is_category2"]."'";
}
if(isset($_POST["is_category3"]))
{
$query .= " AND itemSparse.StatModifier_bonusStat1 = '".$_POST["is_category3"]."'";
}
The problem:
The queries are only working when all three select menus have a selected value. If not all three menus have a selected option no results are shown.
I want that results are shown even if only one or two select menus have options selected. This means a query with an empty $_POST value should be ignored, but the others should be executed. How can I handle that?

Answer 1

The easiest way is to put WHERE 1=1 clause, that will result TRUE. After that you can append any AND clause.
$query = "SELECT * FROM table WHERE 1=1 "
if(isset($_POST["is_category"]))
{
$query .= " AND item.Material = '".$_POST["is_category"]."'";
}
if(isset($_POST["is_category2"]))
{
$query .= " AND itemSparse.OverallQualityID = '".$_POST["is_category2"]."'";
}
if(isset($_POST["is_category3"]))
{
$query .= " AND itemSparse.StatModifier_bonusStat1 = '".$_POST["is_category3"]."'";
}
Also change this to use prepared statement, otherwise the query is vulnerable to SQL Injection attack

Answer 2

The issue you have is that the $_POST variables are all sent, because they are all part of the same form, so the resulting query has all the conditions with ='' for every field that is empty.
So you if you use !empty() instead of isset() your code should work
if(!empty($_POST["is_category"]))
{
$query .= "item.Material = '".$_POST["is_category"]."' AND ";
}
if(!empty($_POST["is_category2"]))
{
$query .= "itemSparse.OverallQualityID = '".$_POST["is_category2"]."' AND ";
}
if(!empty($_POST["is_category3"]))
{
$query .= "itemSparse.StatModifier_bonusStat1 = '".$_POST["is_category3"]."' AND ";
}
However, do note that your query has a major sql injection vulnerability, so such code should not be used in a production environment. For a production server you need to use prepared statement.