Empty Variable in MYSQL string

[_spaz]

Is it possible to process MYSQL statement if one of the 3 variables used is empty?  I want the option to be able to leave a variable blank if nothing is entered in the search form.

 

Example:

Say I do a search by jobid and startdate but leave endate blank....(this is inputted in search form)

 

SELECT * FROM Media WHERE Jobid = '$_POST[option]' AND starttime >= '$_POST[startdate]%' AND endtime <= '$_POST[enddate]%' GROUP BY mediaFile";

[Mchl]

Not without some preprocessing (and you need some escaping as well for security).

 

I'm moving this to PHP Coding Help section. Hopefully someone will help you here. I'm off to sleep myself.

[johnsmith153]

(1.)

 

Always use mysql_real_escape_string:

$sql = sprintf("SELECT * FROM $tableName WHERE fieldName LIKE '%s'",mysql_real_escape_string($fieldName));

 

which is much safer than doing without:

SELECT * FROM Media WHERE Jobid = '$_POST[option]'

 

Without it you will be open to SQL Injection Attacks.

 

 

(2.)

 

You could simply do:

 

if(only box 1 completed) {

$sql = box 1 only

}

 

if(box 1 and 2 completed) {

$sql = box 1 and 2 only

}

 

if(all 3 boxes used) {

$sql = all 3

}

 

This will work but uses multiple IF statements. Someone will probably give you a more refined version - but like I say it would work fine.