Searching with multiple select boxes - php

Question

I am trying to make a query having multiple select boxes, User can select one or multiple values from the drop down menu, But its not working it works only if user select one select box if user tries to select two or more select box values it is not able to display the where clause properly. I saw this code in another web site but not able to pick it properly, If some one can help in understanding or simplifying...
if ($office != '') {
$where = ($where == '') ? 'WHERE ' : 'AND ';
$where .= "adpno = '$office'";
}
if ($sector!= '') {
$where = ($where == '') ? 'WHERE ' : 'AND ';
$where .= "sector= '$sector'";
}
if ($subsector!= '') {
$where = ($where == '') ? 'WHERE ' : 'AND ';
$where .= "subsector= '$subsector'";
}
mysql_query('SELECT * FROM sometable ' . $where);

Answer 1

Make sure to add a space before and after AND and WHERE!
In your code when more than one condition is used, the query is probably built as: SELECT * FROM sometable WHERE subsector=3AND sector=5 (note the lack of space before AND).
In your code sample, there is a space only after AND/WHERE. Note that MySQL ignores whitespaces in the query, so don't worry if it ends up with a double space sometimes. Just make sure to have at least one space, separating all elements of the query.
EDIT: Also, make sure that each if concatenates to the previous WHERE clause instead of overwriting it. So:
if ($office != '') {
$where .= ($where == '') ? ' WHERE ' : ' AND ';
$where .= "adpno = '$office'";
}
if ($sector!= '') {
$where .= ($where == '') ? ' WHERE ' : ' AND ';
$where .= "sector= '$sector'";
}
if ($subsector!= '') {
$where .= ($where == '') ? ' WHERE ' : ' AND ';
$where .= "subsector= '$subsector'";
}
mysql_query('SELECT * FROM sometable ' . $where);

Answer 2

I'd try something like this:
$conditions = '';
if ($tmp = #$_GET['office'])
$conditions .= ($conditions != '' ? ' AND ' : '') . 'office = \'' . mysql_escape_string($tmp) . '\'';
if ($tmp = #$_GET['sector'])
$conditions .= ($conditions != '' ? ' AND ' : '') . 'sector = \'' . mysql_escape_string($tmp) . '\'';
// ...
mysql_query('SELECT * FROM sometable' . ($conditions != '' ? ' WHERE ' . $conditions : '') . 'M');
If you've got more than just two or three fields, a foreach loop might be better suited:
$conditions = '';
$fields = array('office', 'sector', 'subsector', /*...*/);
foreach ($fields as $field)
if ($tmp = #$_GET[$field])
$conditions .= ($conditions != '' ? ' AND ' : '') . $field . ' = \'' . mysql_escape_string($tmp) . '\'';
mysql_query('SELECT * FROM sometable' . ($conditions != '' ? ' WHERE ' . $conditions : '') . 'M');
You could even simplify code a bit by always having at least one condition (untested, but should work):
$conditions = 'TRUE';
$fields = array('office', 'sector', 'subsector', /*...*/);
foreach ($fields as $field)
if ($tmp = #$_GET[$field])
$conditions .= ' AND ' . $field . ' = \'' . mysql_escape_string($tmp) . '\'';
mysql_query('SELECT * FROM sometable WHERE ' . $conditions . ';'));

Answer 3

$fields = array('sector' , 'subsector' , 'office');
$query = '';
foreach($fields as $field)
{
if($query != '')
$query .= ' AND ';
if( $input[$field] != '')
$query .= $field ." = '". $input[$field] ."'";
}
I would recommend you to use mysqli or pdo instead of mysql.
$input is an array of the input values after you've made "security checks",
for instance: mysql_escape_string and htmlspecialchars