Search Filtering with PHP/MySQL

Like all the other post you will need to append all the conditions with AND like so. This is the cleanest answer so far. Remember to real escape your strings though use the mysqli OOP way instead of the old mysql. Just a suggestion.

Heres an example of a typical query.

The correct way:

SELECT * FROM donar WHERE name='dxenaretionx' AND sex='M';

The way you are doing it

SELECT * FROM donar WHERE name='dxenaretionx' sex='M';

Code:

function search_donar($_POST) {
    $by_name = $_POST['by_name'];
    $by_sex = $_POST['by_sex'];
    $by_group = $_POST['by_group'];
    $by_level = $_POST['by_level'];

    //Do real escaping here

    $query = "SELECT * FROM donar";
    $conditions = array();

    if(! empty($by_name)) {
      $conditions[] = "name='$by_name'";
    }
    if(! empty($by_sex)) {
      $conditions[] = "sex='$by_sex'";
    }
    if(! empty($by_group)) {
      $conditions[] = "blood_group='$by_group'";
    }
    if(! empty($by_level)) {
      $conditions[] = "e_level='$by_level'";
    }

    $sql = $query;
    if (count($conditions) > 0) {
      $sql .= " WHERE " . implode(' AND ', $conditions);
    }

    $result = mysql_query($sql);

    return $result;
}

There in Your code there is problem in query where condition . Here your query will be like select * from donar where by_name = "A" by_group = "N" there is No And/Or to make where condition properly. Please try code like given below.

$search_query = "SELECT * FROM donar";
$query_cond = "";

if($by_name !="") {
      $query_cond .= " name='$by_name'";
}
if($by_sex !="") {

      if(!empty($query_cond)){
          $query_cond .= " AND ";
       }

      $query_cond .= " sex='$by_sex'";
}

if($by_group !="") {

      if(!empty($query_cond)){
          $query_cond .= " AND ";
       }

      $query_cond .= " blood_group='$by_group'";
}

if($by_level !="") {

      if(!empty($query_cond)){
          $query_cond .= " OR ";
       }

      $query_cond .= " e_level='$by_level'";
 }

 if(!empty($query_cond)){
      $query_cond = " Where ".$query_cond;
      $search_query.$query_cond;
 }

Here in code First we take $query_cond variable empty and make condition according code. and manage AND operator according that. And in last if We found $query_cond not empty then add it to $select_query.

I hope it will be helpful for you.

thanks

The following code snippet:

$search_query = "SELECT * FROM donar WHERE";
if($by_name !="") {
  $search_query .= " name='$by_name'";
}
if($by_sex !="") {
  $search_query .= " sex='$by_sex'";
}

produces queries like

SELECT * FROM donar WHERE name='nowak' sex='m'

, which are not valid because there is no logical operator between the clauses. You need to add an 'AND'. To simplify code, you can generate conditions in the form of "true and a and b ...":

$search_query = "SELECT * FROM donar WHERE true";
if($by_name !="") {
  $search_query .= " AND name='$by_name'";
}
if($by_sex !="") {
  $search_query .= " AND sex='$by_sex'";
}
...