Error in mysql query in select - php

Question

I have a problem, I wanted to make a query to the search form data where people insert some filters will search for products appear less in this specific case are houses.
had made a query with "or" does not work as well as this it makes the fields alone, and "and" not also works because I do not want users to fill out all the fields, so is the they want, so I did it
$texto = array();
$contador=0;
if($_SESSION["finalidade"]!=""){
$contador++;
$texto[1]="`finalidade` LIKE ".$finalidade;}
if($_SESSION["tipoimovel"]!=""){
$contador++;
$texto[2]="`tipoimovel` LIKE ".$tipoimovel;}
if($_SESSION["nquarto"]!=0){
$contador++;
$texto[3]="`nquartos` = ".$nquarto;}
if($_SESSION["pmin"]!=0){
$contador++;
$texto[4]="`preco` > ".$pmin;}
if($_SESSION["pmax"]!=0){
$contador++;
$texto[5]="`preco` < ".$pmax;}
if($_SESSION["elevador"]!=""){
$contador++;
$texto[6]="`elevador` LIKE ".$elevador;}
if($_SESSION["garagem"]!=""){
$contador++;
$texto[7]="`garagem` LIKE ".$garagem;}
if($_SESSION["vistapriv"]!=""){
$contador++;
$texto[8]="`vistapreveligiada` LIKE ".$vistapriv;}
if($_SESSION["piscina"]!=""){
$contador++;
$texto[9]="`piscina` LIKE ".$piscina;}
if($_SESSION["jardim"]!=""){
$contador++;
$texto[10]="`jardim` LIKE ".$jardim;}
if($_SESSION["condominiof"]!=""){
$contador++;
$texto[11]="`condominio` LIKE ".$condominiof;}
if($_SESSION["conselho"]!=""){
$contador++;
$texto[12]="`conselho` LIKE ".$conselho;}
if($_SESSION["frequesia"]!=""){
$contador++;
$texto[13]="`frequesia` LIKE ".$frequesia;}
if($_SESSION["refimovel"]!=""){
$contador++;
$texto[14]="`referencia` LIKE ".$refimovel;}
$textocompleto="";
$contador2=1;
for($y = 0; $y < 16; $y++) {
if($texto[$y]!=""){
if($contador2==1 && $contador2!=$contador){
$contador2++;
;
$textocompleto=$texto[$y]." AND "; }
elseif($contador2==$contador){
$contador2++;
$textocompleto=$textocompleto.$texto[$y];}
elseif($contador2==1 && $contador2==$contador){
$contador2++;
$textocompleto=$texto[$y]; }
else {
$contador2++;
$textocompleto=$textocompleto.$texto[$y]." AND ";}
}
}
$results = $mysqli->prepare("SELECT ID, imagem, frequesia ,conselho, preco FROM `imovel` WHERE ? ORDER BY `imovel`.`preco` DESC LIMIT ?,? ");
$results->bind_param("sii",$textocompleto, $page_position, $item_per_page);
$results->execute();
$results->bind_result($id ,$imagem, $frequesia ,$conselho, $preco); //bind variables to prepared statement
}
the problem is that it is not me to return anything, does not show me any value.
already do not know what else to do because if you make a if for each of the possibilities will give more than 100 if and will take a long time.
if anyone knows of some effective and quick way to do this please help me, because in fact not know what else to do to fix this problem, thank you

Answer 1

You cannot bind parts of an SQL statement, you can only bind values.
So this is valid:
$results = $mysqli->prepare("SELECT col1, col2 FROM tbl WHERE col3 = ?");
$results->bind_param("i", 1234);
and this is not:
$results = $mysqli->prepare("SELECT col1, col2 FROM tbl WHERE ?");
$results->bind_param("s", "col3 = 1234");
You can concatenate the strings, though:
prepare("SELECT ... WHERE ".$textocompleto." ORDER BY imovel.preco DESC LIMIT ?,? ");

Answer 2

You can use a prefix on your $\_SESSION variable like sf_{variable_name} for all required fields. After that, you can loop throughout them to build your query
(ps : code not tested):
$sql = "SELECT ";
$sql_cond = " WHERE ";
$texto = [];
foreach($_SESSION as $k => $v){
if(substr($v, 0, 3) == "sf_"){
$name = substr($k, 3, strlen($k))
$texto[$name] = $v;
$sql .= $name.", ";
$sql_cond .= $name." LIKE :".$name;
}
}
$final_sql = $sql.$sql_cond;
$results = $mysqli->prepare($final_sql);
foreach($texto as $k => $v){
$results->bind_param(":".$k, "%".$v."%");
}
$results->execute();
Ok, after some tests, i did the same with PDO object in a test db for medias (PDO is nearly the same stuff than MYSQLI object), and it work fine for me, just adapt your db ids for your case
$pdo = new PDO('mysql:host=localhost;dbname=media_center', 'root', 'root');
$_SESSION["sf_title"] = "Interstellar";
$_SESSION["sf_description"] = "sci-fi";
$sql = "SELECT * ";
$sql_cond = " WHERE ";
$texto = [];
foreach($_SESSION as $k => $v){
if(substr($k, 0, 3) == "sf_"){
$name = substr($k, 3, strlen($k));
$texto[$name] = $v;
$sql_cond .= $name." LIKE :".$name." OR ";
}
}
$sql_cond = substr($sql_cond, 0, strlen($sql_cond)-4);
$final_sql = $sql." FROM media ".$sql_cond;
$results = $pdo->prepare($final_sql);
foreach($texto as $k => $v){
$key = ":".$k;
$value = "%".$v."%";
$results->bindParam($key, $value);
}
$results->execute();

Answer 3

I guess you will need to wrap the values in single qoute ''
For example:
$texto[1]="`finalidade` LIKE ".$finalidade;
should be
$texto[1]="`finalidade` LIKE '".$finalidade."'";
Try this.. I think it will solve it