Filters not working (Executing different PHP queries based on parameters)

Instead of this code:

 htmlentities (strip_tags(@$_POST['gender']));

you should validate it, like so:

 $gender = filter_input(INPUT_POST, 'gender', FILTER_VALIDATE_REGEXP, ['options' => ['regexp' => '/^[mf]$/i']]);
 $ageFrom = filter_input(INPUT_POST, 'age_from', FILTER_VALIDATE_INT, [ 'default' => 1, 'min_range' => 1, 'max_range' => 100]);
 $ageTo = filter_input(INPUT_POST, 'age_to', FILTER_VALIDATE_INT, [ 'default' => 1, 'min_range' => 1, 'max_range' => 100]);
 $studying = filter_input(INPUT_POST, 'gender', FILTER_VALIDATE_REGEXP, ['options' => ['regexp' => '/^(similar|different|same)$/i']]);

This is simpler and more secure.

Each input should be properly validated.

Avoid using @.

Once you have the values, you can concatenate them in to your query, like so:

$types = '';
$values = [];
$query = 'SELECT * FROM users';
$where = [];

// empty tests for both null (no data in input) and false (invalid data)
if (!empty($gender)) {
    $where[] = 'gender = ?';
    $types .= 's';
    $values[] = &$gender;
}
if (!empty($ageFrom)) {
    $where[] = 'age >= ?';
    $types .= 'i';
    $values = &$ageFrom;
}
if (!empty($ageTo)) {
    $where[] = 'age <= ?';
    $types .= 'i';
    $values = &$ageTo;
}
if (!empty($studying)) {

    $field = 'user_bio';

    // Get the $user_bio value of the current user from the database

    // Change the $user_bio into a regular expression collection of words
    $regexp = '('.str_replace(' ','|',$user_bio).')';

    // Set up the where 
    switch ($studying) {
        case 'same':
            $comparison = '= ?';
            break;
        case 'different':
            $comparison = 'NOT REGEXP (?)';
            break;
        case 'similar':
            $comparison = 'REGEXP (?)';
            break;                
    }
    $where[] = $field.' '.$comparison;
    $types .= 's';
    $values[] = &$user_bio;
}

if (count($where) > 0) {
    $query .= ' WHERE '.implode(' AND ',$where);
}

// new mysqli ( host, 
$mysqli = new mysqli('localhost','root','','stuff');
$stmt = $mysqli->prepare($query);

// This allows you to use a variable number of arguments with the prepared statement
// Note the use of the ampersands on the array assignment, this ensures they are passed by reference
$params = array_merge([$types],$values);
call_user_func_array([$stmt,'bind_param'],$params);

$stmt->execute();

// Bind a variable for each column
$stmt->bind_result($user_name);

while ($stmt->fetch()) {
var_dump($result);
}

(I'm not sure why the answers already provided don't address your question sufficiently.)

I'd approach it like this. First, get rid of that first query execution to pull all users. Instead, use just a single query.

Dynamically prepare the SQL text. Start the statement with the "SELECT ... FROM users". (We'll handle appending an ORDER BY as the last step.

I'd conditionally check each "filter", to see if I need to append a condition to the WHERE clause or not.

At the start of the SQL, we'll include a "WHERE 1=1".

$sql = "SELECT ... FROM users u" 
$sql .= " WHERE 1=1";

The "WHERE 1=1" is basically useless. The optimizer is going to throw that away. The reason we add it is just to make our code easier later. We can just append our next filter with " AND condition", and not worry about whether this is the first one, and we need to use WHERE instead of AND.

We'll initialize a string and an array, to hold our bind types string "sssis" whatever it needs to be, and an array of references to the values we want to pass in.

  $bind_type = "";
  $bind_vals = array();

The processing for each filter is going to be icky... but we can do it. Check if we need to append anything to the SQL. If we do, figure out what needs to be added, including any bind placeholders. And append the type of the bind parameter ("i", "s", whatever) to the $bind_type string, and push (the reference to) a value into our $bind_vals array.

if ( $refined_gender ) {
   // figure out what that SQL text needs to look like
   // append the string to the SQL text
   $sql .= " AND u.gender = ?";

   // append type to string, and push a reference to the value into array 
   $bind_types .= "s";
   $bind_val[] = &$refined_gender;
}

Our code in there is going to be more complicated than that. That's just handling an equality comparison. We're just keeping things simple now, to illustrate the pattern.

We repeat the same kind of thing for each filter we might need to add. Check if it's needed, figure out what we need to append to the SQL text, append to the bind_types string and push (a reference to) the value into the bind_vals array.

For working this out, I'd start with working on just one condition, and get that working, to get the kinks worked out. When we add more filters, and things go awry, I know where to look for the problem. (I know what was working before.)

When I'm done with the WHERE clause, I append any ORDER BY and LIMIT that I need. This could be conditional, but in the end, we're going to wind up doing something like this:

   $sql .= " ORDER BY u.id DESC LIMIT 50";

When I'm done with all that, I've got a string containing SQL text that looks something like this:

  SELECT ...
    FROM users u 
   WHERE 1=1
     AND u.gender = ?
     AND u.age_from >= ?
     AND u.age_to   <= ?
   ORDER BY u.id DESC
   LIMIT 50

(in this example, it contains three bind placeholders. If we've done it right,

we'll have a $bind_types string containing three characters, e.g. "sii"

And we'll have a $bind_vals array that contains references to three values.

Now, we can call mysqli_stmt_prepare. If there's not an error in our SQL, we should get back a statement handle.

$stmt = mysqli_prepare($conn,$sql);

(Check the return from the prepare.)

Now we just need to bind our parameters. And this is where mysqli makes things a little hairy. If we were using PDO (or Perl DBI), calling the "bind parameter/bind value" would be easy. Those would let us pass an array of the bind values. But not mysqli. He won't let us call mysqli_stmt_bind_param with an array as an argument.

We need to run a function call like this:

mysqli_stmt_bind_param($stmt, $bind_types, &$refined_gender, &$age_from, ... );

And our problem is that we have a variable number of arguments.

There is a workaround.

We can use the call_user_func_array function.

Because the code is using procedural style and not object oriented style, the handle to the prepared statement is the first argument, the second argument is the bind types string, followed by the bind values. The bind values are already in an array. We just need to get all of those into one hugh jass array.

The array_merge function seems to be custom designed for doing this.

 // array_merge(array($stmt), array($bind_types), $bind_vals)

That will return us a single array. Which is exactly what we need for calling the call_user_func_array function. We aren't going to need that array anywhere else (unless we're debugging, and we want to print it out).

We only need to call mysqli_stmt_bind_param if we have at least one bind placeholder in our statement. So we can shortcut around this if our $bind_types string is empty. (And we know $bind_types won't be "0" because our code never appended a "0" to it.)

 if ($bind_types) {
    call_user_func_array('mysqli_stmt_bind_param', array_merge(array($stmt), array($bind_types), $bind_vals) );
 }

The first argument (to call_user_func_array) is the name of the function we want to execute, and the second argument is the hugh jass array that we want converted into a list.

And the whole point of doing that is making it dynamic, we can pass in one, two, three, bind values.

At this point, we're ready to execute the statement, and fetch the results.

Again, important to point out: mysqli_stmt_bind_param expects the bind values to be passed by reference, not by value. And that's why we pushed references to the values into the bind_vals array.

I'm not sure what question you asked.

But definitely ditch that first call to mysqli_query. That's going to return all rows in the users table.

With one or two conditions, the approach of static SQL and static bind types, and listing out the bind values is workable.

But when we get three, four, five possible filters, and all the possible combinations, that's going to be unweildy.

So we go with a more dynamic approach, dynamically creating the query, and pushing our bind values on an array as go.

This Html page:

<form method="POST" action="">
    <input type="radio" name="rbo_gender" value="male">Male
    <input type="radio" name="rbo_gender" value="female">Female
    Age From<select name="agefrom">
        <?php
        for($i=10;$i<50;$i++):
        ?>
        <option value="<?php echo $i?>"><?php echo $i?></option>
        <?php
        endfor;
        ?>
    </select>
    Age To<select name="ageto">
        <?php
        for($i=10;$i<50;$i++):
        ?>
        <option value="<?php echo $i?>"><?php echo $i?></option>
        <?php
        endfor;
        ?>
    </select>
    Studying:
    <input type="radio" name="rbo_type" value="similar">Similar
    <input type="radio" name="rbo_type" value="exact">Exactly same
    <input type="radio" name="rbo_type" value="different">Different
    <input type="submit" name="btnsearch" value="Search">
</form>

This is php part:

if($_POST["btnsearch"])
{
   if(!empty($_POST["rbo_gender"]))
   {
       $gender = $_POST["rbo_gender"];
       $cond .= " and gender = '".$gender."'";
   }
   if(!empty($_POST["agefrom"]))
   {
       $agefrom = $_POST["agefrom"];
       $cond .= " and age >= '".$agefrom."'";
   }
   if(!empty($_POST["ageto"]))
   {
       $ageto = $_POST["ageto"];
       $cond .= " and age <= '".$ageto."'";
   }
   if(!empty($_POST["rbo_type"]))
   {
       $user_type = $_POST["rbo_type"];
       switch($_POST["rbo_type"])
       {
           case "similar": $cond .= " and user_bio like '%".$ageto."%'";
               break;
           case "exact": $cond .= " and user_bio = '".$ageto."'";
               break;
           case "different":$cond .= " and user_bio ! like '%".$ageto."%'";
               break;       
       }
   }

   $query = "select * from users where 1 ".$cond;
}

Please update query as per mysqli() & use bind param. Also instead of use @ try to use filter_input you can use REGEXP instead of like also. I have created the variable to use bind_param purpose.