How to build a SQL statement when any combination of user input to the table is possible?
- by Greg McNulty
Example: the user fills in everything but the product name.
I need to search on what is supplied, so in this case everything but productName=
This example could be for any combination of input.
Is there a way to do this?
Thanks.
$name = $_POST['n'];
$cat = $_POST['c'];
$price = $_POST['p'];
if( !($name) )
{
$name = some character to select all?
}
$sql = "SELECT * FROM products WHERE productCategory='$cat' and
productName='$name' and productPrice='$price' ";
EDIT
Solution does not have to protect from attacks. Specifically looking at the dynamic part of it.
