Correct way to handle changeable queries in PDO? - php

Question

I am currently building a news website that has features such as posting content, labeling the content into categories and voting.
I have gotten to the stage where I am making a home feed for my users, this will show the newest posts but I want to give my users the ability to sort by categories.
Here is my current query
SELECT p.*,
(SELECT Count(id)
FROM comments AS c
WHERE c.post = p.id) AS commentCount,
v.type AS vote_type,
(SELECT Count(id)
FROM votes AS vo
WHERE vo.post_id = p.id) AS totalVotes
FROM posts AS p
LEFT JOIN tagged AS t
ON p.id = t.post_id
LEFT JOIN votes AS v
ON v.post_id = p.id
WHERE (v.user_id = 1 OR v.user_id IS NULL)
AND t.tag_id = 7
ORDER BY timestamp DESC
LIMIT :limit OFFSET :offset
This query has the following parts of code that make it return posts that are only assigned (tagged) with the category id of 7 ( and without these two parts the query becomes the base query I normally use for newest posts)
LEFT JOIN tagged AS t
ON p.id = t.post_id
AND t.tag_id = 7
I was wondering if there is a way to have the base query without the category code and then if needed input the category code rather than have two querys? Is there a way to make a query 'dynamic'.
I want to implement other sorting features but feel creating a bunch of (slightly) different copies of each other would be inefficient.

Answer 1

Yes, people do this all the time. You can either dynamically set your parameters, such as in the first example below, or you can dynamically build your SQL statement. I would think best practice would be to: 1. Make sure it doesn't get too complicated. At the point that you have a query that is everything to everybody, look at building a query builder or multiple queries. 2. Combine dynamic SQL statements with dynamic parameters.
Prepare your statement:
SELECT p.*,
(SELECT Count(id)
FROM comments AS c
WHERE c.post = p.id) AS commentCount,
v.type AS vote_type,
(SELECT Count(id)
FROM votes AS vo
WHERE vo.post_id = p.id) AS totalVotes
FROM posts AS p
LEFT JOIN tagged AS t
ON p.id = t.post_id
LEFT JOIN votes AS v
ON v.post_id = p.id
WHERE (v.user_id = 1 OR v.user_id IS NULL)
AND t.tag_id = :tagid
ORDER BY timestamp DESC
LIMIT :limit OFFSET :offset
Now bind your element (pseudo code):
if( ! isset( $someValue ) ) $someValue = 7; // I am just giving it a default value for
// an example. You can do whatever.
pdo->bindParam( ':tagid', $someValue, parameterType such as PDO::PARAM_INT);
You can keep building like this, or you can break up your bigger SQL prepared statement. By way of example:
if( $categoryCodeNeeded === true ) // add another and statement to where portion of your sql statement
$select += " AND tag_id = 7 ";
Edit to answer the question in the comment:
The code that you provided: SELECT p.* is either assigned to a variable right now, or it is inside another piece of code that looks like this:
$statement = $dbHandler->prepare('SELECT p.* FROM posts p blah blah blah' );
If it's the second case, then you can change that line of code to read:
$statement = $dbHandler->prepare( $yourOwnSelectVariable );
Then, you can build your variable however you want.
$yourOwnSelectVariable = "SELECT p.* FROM posts p";
if( $categoryCodeNeeded )
$yourOwnSelectVariable += " WHERE tag_id = :tagid ";
$statement = $dbHandler->prepare( $yourOwnSelectVariable );
if( ! isset( $tagId ) ) $tagId = 7;
$statement->bindParam( ':tagid', $tagId, PDO::PARAM_INT);