Single Quotes and $_POST data

[krystofurr]

So basically I have this scenario. I have 2 php files. One " searchpage.php " and " results.php ". The searchpage has multiple drop down menus with different values in it. The values for each consist of a partial mysql query. Example below:

 

<?

$minpayout_0="";

$minpayout_1="min_payout='No minimum'";

$minpayout_2="min_payout ='5'";

$minpayout_3="min_payout ='10'";

$minpayout_4="min_payout ='15 '";

$minpayout_5="min_payout ='20'";

   

        echo "<SELECT NAME='minpayout_select'>

<OPTION VALUE='$minpayout_0'>Select Min Payout Amount...

 

<OPTION VALUE='$minpayout_1'>No minimum

<OPTION VALUE='$minpayout_2'>$5.00

<OPTION VALUE='$minpayout_3'>$10.00

            <OPTION VALUE='$minpayout_4'>$15.00

            <OPTION VALUE='$minpayout_5'>$20.00

</SELECT>";

 

?> 

 

I know I must be missing something.  I then post the value to the results page to an array as so below:

 

$select_Array = array(

'0' => $_POST['minpayout_select']

);

 

So I find that with the single quotes I get the result as " minpayout= " missing the  "  'No minimum' " section of it.  Without the quotes displays the no minimum.  I know there is something with the quotes obviously but have tried many things and not sure what to do.  Please help or provide a workable example. Thanks

[DarkWater]

You need to use htmlentities($text, ENT_QUOTES); on it to use it in HTML...but why not just use 0, 5, 10, 15, and 20 as the value instead of a string?  I don't understand why you'd do that.

[krystofurr]

Not sure myself. Thank you for the fast response. Sorry forgot to put my code in code blocks.  I am doing it this way because if I just post the value I need to build the query in the results page.  There are multiple drop downs in the search page and I have to kind of dynamically build the query based on user input. Or maybe I'm overthinking it as I always do...

[DarkWater]

Can't you just add:

 

$minpayout = (int) $_POST['minpayout_select'];

$query .= "min_payout=$minpayout";

 

Also, I wouldn't mix numbers and strings in the query.  Just makes No minimum 0 in the database.

[marcus]

There's also no use of defining the variables like that when you can simply put them in the single quotes at real numbers/strings.

[krystofurr]

Hm, ya. I'll give it a try again just using numerical. To be honest I'm not sure why I used strings for the values in the database DW.  I'm just starting out on this stuff and my head has been spinning on this for 2 weeks now...lol. I just want to search a database basically with about 4 drop down menus with different values and based on what the user picks display the records on it but it seems difficult for some reason.  A good example I know of it is at mpogd.com in the advanced search cept only with 4 options to chose. Cheers

[marcus]

For an ideal advanced search system, you can easily start by defining what table you're looking in.

 

<?php
$by = $_POST['by'];
$type = $_POST['type'];
$query = $_POST['query'];

// of course you should protect the data above

$sql = "SELECT * FROM `users`";

switch($type){
case 'exact': $addon = "='".$query."'"; break;
case 'cont': $addon = " LIKE '%".$query."%'"; break;

default: $addon = "='".$query."'";
}

switch($by){
case 'username': $sql .= " WHERE `username`" . $addon; break;
case 'email': $sql .= " WHERE `email`" . $addon; break;
case 'name': $sql .= " WHERE `name`" . $addon; break;

default: $sql .= " WHERE `username`" . $addon;
}

$res = mysql_query($sql) or die(mysql_error());

if(mysql_num_rows($res) == 0){
echo "Your search returned no results!";
}else {
while($row = mysql_fetch_assoc($res)){
	echo $row['username'] . " // " . $row['email'] . " // " . $row['name'] . "<br>\n";
}
}
?>