Add where clauses to sql select dynamically

Question

In a webshop admin, i am listing out the orders from sql. Here, i have a search form also, where i type in a keyword, and start search.

Now, i added a date from, and a date end input to the form. How can i add these to the sql select, if the admin enter the dates, not just the keyword only?

<td style="text-align: center;">
    <input type="text" name="date_from" value="<?php if(isset($_POST['date_from'])) { echo $_POST['date_from'];} ?>" size="7"  class="datepicker">
    <span> - </span>
    <input type="text" name="date_end" value="<?php if(isset($_POST['date_end'])) { echo $_POST['date_end'];} ?>" size="7"  class="datepicker">
</td> 

$sql = "SELECT rendeles_user_id , rendeles_id, nev, status, vegosszeg,br_vegosszeg, datum, ido, egyeb FROM rendeles_adatok WHERE $kereses_helye LIKE '%$kw%' ORDER BY $kereses_rendezes $kereses_sorrend";

$kereses_helye means that where i want to search. (user name, order id, email....)

where are you assigning $kereses_helye? Show the complete code or this is not something that can really be helped. Make sure you have the form sending and receiving the data. This is too hard to follow right now. — Apps-n-Add-Ons
– Apps-n-Add-Ons, Commented Dec 16, 2017 at 11:19

Professor Abronsius · Accepted Answer · 2017-12-16 11:27:27Z

1

You could build the where clause before the sql statement based upon the existence of POST date values - it's not pretty and this and the original code are vulnerable to sql injection. I assumed ( probably incorrectly ) in the query that the column datum was a date column in the db

$where = !empty( $_POST['date_from'] ) && !empty( $_POST['date_end'] ) ? "where `$kereses_helye` like '%$kw%' and `datum` between '{$_POST['date_from']}' and '{$_POST['date_end']}' " : "where `$kereses_helye` like '%$kw%'";

$sql = "select 
    rendeles_user_id,
    rendeles_id,
    nev,
    status,
    vegosszeg,
    br_vegosszeg,
    datum,
    ido,
    egyeb 
    from rendeles_adatok 
    {$where}
    order by $kereses_rendezes $kereses_sorrend";

edited Dec 16, 2017 at 11:27

answered Dec 16, 2017 at 11:18

Professor Abronsius

33.9k5 gold badges36 silver badges49 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

KissTom87 Over a year ago

But if date_from is empty, and date_end is not empty?

Professor Abronsius Over a year ago

!empty( $_POST['date_from'] ) && !empty( $_POST['date_end'] ) ~ it should require both be NOT empty to proceed

Collectives™ on Stack Overflow

Add where clauses to sql select dynamically

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related