Search database with 6 user inputs - php

Question

I have a database with vehicle information in it (make, model, year, branch, etc)
I need to create a search form to search this database. The search form consists of 4 selection boxes and two text boxes.
Please find the code below trying to query the database:
<?php
$dbName = "F:/Domains/autodeal/autodeal.co.za/wwwroot/newsite/db/savvyautoweb.mdb";
// Throws an error if the database cannot be found
if (!file_exists($dbName)) {
die("Could not find database file.");
}
// Connects to the database
// Assumes there is no username or password
$conn = odbc_connect("Driver={Microsoft Access Driver (*.mdb)};Dbq=$dbName", '', '');
if (isset($_REQUEST['submit'])) {
$searchMake = addslashes($_POST['makeSelection']);
$searchModel = addslashes($_POST['modelSelection']);
$searchBranch = addslashes($_POST['branchSelection']);
$searchYear = addslashes($_POST['yearSelection']);
$minPrice = addslashes($_POST['minPriceSelection']);
$maxPrice = addslashes($_POST['maxPriceSelection']);
$sql = "SELECT Id, Make, Model, Year, Price, SpecialPrice, Branch, StockNO FROM Vehicle WHERE Price >= '$minPrice' AND Price <= '$maxPrice' AND Make LIKE '$searchMake' AND Model LIKE '$searchModel' AND Branch LIKE '$searchBranch' AND Year LIKE '$searchYear'";
$rs = odbc_exec($conn, $sql);
} else {
$sql = "SELECT Id, Make, Model, Year, Price, SpecialPrice, Branch, StockNO FROM Vehicle ORDER BY Make";
$rs = odbc_exec($conn, $sql);
}
echo "\t" . "<tr>\n";
echo "\t" . "<th>Make</th><th>Model</th><th>Year</th><th>Price</th><th>Special Price</th><th>Location</th><th>Stock Number</th>" . "\n";
while (odbc_fetch_row($rs)) {
$id = odbc_result($rs, Id);
$make = odbc_result($rs, Make);
$model = odbc_result($rs, Model);
$year = odbc_result($rs, Year);
$price = odbc_result($rs, Price);
$specialPrice = odbc_result($rs, SpecialPrice);
$branch = odbc_result($rs, Branch);
$stockNo = odbc_result($rs, StockNO);
echo "\t" . "<tr>\n";
echo "\t\t" . "<td>" . $make . "</td><td><a href=/newsite/selected-vehicles?Id=$id>" . $model . "</a></td><td>" . $year . "</td><td>" . $price . "</td><td>" . $specialPrice . "</td><td>" . $branch . "</td><td>" . $stockNo . "</td>\n";
echo "\t" . "</tr>\n";
}
odbc_free_result($rs);
odbc_close($conn);
// This message is displayed if the query has an error in it
if (!$rs) {
exit("There is an error in the SQL!");
}
?>
When I run this script, "there is an error in the SQL" message appears.
Any help would be greatly appreciated.
Thannk you

Answer 1

The sql query which you are making depending upon the user inputs should be modified as there is huge chances it will fail as user may or may not enter all the text boxes. Basically, you you create dynamic query with if else conditions
$sql = "SELECT Id, Make, Model, Year, Price, SpecialPrice, Branch, StockNO FROM Vehicle WHERE 1 = 1;
if ($minPrice > -1 )
{
$sql .= $sql " and Price >= $minPrice ";
}
Similarly for others and in comparison operators > < you shouldn't add single quotes with price.
Try to print your query and check how is it formed-