Printing SQL query results PHP - php

Question

I am looking to be able to search a SQL database using a form and output the finds on the screen.
This is my code:
$query = "SELECT * FROM documents WHERE DocumentName = '%".$DocumentName."%'AND county = '".$county."' OR acreage = '".$acreage."' AND grantor = '".$grantor."' OR grantee = '".$grantee."' ORDER by 'DocumentName'" ;
$result=$db->query($query);
$num_results=$result->num_rows;
echo "<p>Number of documents found: ".$num_results."</p>";
for($i=0; $i <$num_results; $i++){
$row=$result->fetch_assoc();
echo"<p>".($i+1).".County: ";
echo htmlspecialchars(stripslashes($row['county']));
echo "<br />Acreage: ";
echo stripslashes($row['acreage']);
echo "<br />Grantor: ";
echo stripslashes($row['grantor']);
echo "<br />grantee: ";
echo stripslashes($row['grantee']);
echo "<br />Lessor: ";
echo stripslashes($row['DocumentName']);
echo "<br />PDF: ";
echo stripslashes ("" .$row['PDF'] . "<br>");
echo "</p>";
}
$result->free();
$db->close();
It selects and outputs the information. The thing is I need people to be able to leave a field blank the search form however this causes all data to be displayed. If they type in the county and leave everything else blank I want it to pull only that county records.

Answer 1

You can break where clause conditions like:
$where = '';
$where .= empty(county) ? '' : "AND county='$county' ";
...
And inject $where in the query.

Answer 2

Try something like this (to display that data only if associated form field is send and not empty)
if(isset($_POST['country']) && strlen($_POST['country'])>0) echo ($i+1).".County: ". htmlspecialchars(stripslashes($row['county']));
if(isset($_POST['acreage']) && strlen($_POST['acreage'])>0) echo "<br />Acreage: ". stripslashes($row['acreage']);
// ...

Answer 3

I would recommend checking the post values are set and storing where conditions in an array and then using implode to make a string for use in your query.
if(isset($_POST['country']) && strlen($_POST['country'])) {
$where[] = "country = '$country'";
}
if(isset($_POST['acreage']) && strlen($_POST['country'])) {
$where[] = "acreage = '$acreage'";
}
....
$where = isset($where) ? ' WHERE '.implode(' AND ',$where) : '';
$query = 'SELECT * FROM documents'.$where;
It is also worth noting that you have no protection from SQL injection attacks, you need to sanitise your input.