Re: Re: Building a query string

Ed Curtis wrote:

To answer the question, $query_str.=" AND garage = '$garage' "; BUT. If $garage is an id (numeric), then you should use $garage=abs($garage) first in order to defeat SQL injection. If it's a string, well, say so and we'll tell you what to do (a lot to explain, and not useful if it's an ID). Bogdan

All values pulled from $_POST are strings such as $garage = "Attached 2 Car" or "Detached 1 Car", etc. There are a few options that will be based on a checkbox. If the box is checked it means you want that option included in the query as well, i.e. (fireplace == "yes".) If the box is not checked it means no, i.e (fireplace == "no".)

You need to use isset() when dealing with checkboxes. If the box is checked, the variable will be set, otherwise it is not... <?php if(isset($_POST['fireplace'])) { $criteria = " AND fireplace = 'Yes' "; } -- ---John Holmes... Amazon Wishlist: www.amazon.com/o/registry/3BEXC84AB3A5E/ php|architect: The Magazine for PHP Professionals – www.phparch.com