Member Avatar for justinmyoung

I've been able to put together a basic search form that allows users to search my database by entering their last name. My question is how do I offer them an option, using a radio button, to allow them to search by, for example, a city or state or age, etc. Here is the code I have in place for a search of a user's last name:

<?php 

	$SQL_FROM = 'adr';
	$SQL_WHERE = 'last';

?>
<?php
	$searchq		=	strip_tags($_GET['q']);
	$getRecord_sql	=	'SELECT * FROM '.$SQL_FROM.' WHERE '.$SQL_WHERE.' LIKE "'.$searchq.'%"';
	$getRecord		=	mysql_query($getRecord_sql);
	if(strlen($searchq)>0){

	echo '<ul>';
	while ($list = mysql_fetch_array($getRecord)) {?>
		<li><a href="runners2.php?name=<?php echo urlencode($list['first'].' '.$list['last']); ?>"><?php echo $list['last']; ?> <small><?php echo $list['first']; ?></small><small><?php echo $list['city']; ?></small><small><?php echo $list['age']; ?></small></a></li>
	<?php } 
	echo '</ul>';
	?>
<?php } ?>

If I used a radio button, this code would represent my "last name" search, but how would I also allow the user to search via other options? I'm assuming I would use IF...Else, but don't know how to construct the code around this search code.

  • 2 Contributors
  • 2 Replies
  • 128 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by justinmyoung

Dani AI

Generated

The simplest, safest pattern is: give the radio buttons a single name (for example by) with short values you control, then on the server map those values to real column names and use a prepared statement. This avoids putting raw user input into SQL. has the right idea about switching the search column; is correct that a conditional (switch/if) can pick the column, but a small whitelist map is cleaner and less error-prone.

Example form (HTML):

<form method="get" action="search.php">
  <input type="text" name="q" placeholder="Search term">
  <label><input type="radio" name="by" value="last" checked> Last name</label>
  <label><input type="radio" name="by" value="city"> City</label>
  <label><input type="radio" name="by" value="age"> Age</label>
  <button type="submit">Search</button>
</form>

Server-side approach (PHP + PDO): build a small whitelist array that maps allowed by values to actual column names, validate the chosen key exists, then prepare a query and bind the search term (do not bind the column — insert the verified column name into the SQL). For numeric fields (age) validate/cast to integer and use = or range queries instead of LIKE.

Quick tips and cautions:

  • Never trust a raw column name from the client. Use a whitelist lookup to prevent injection.
  • Use prepared statements (PDO or mysqli) — the old mysql_* functions are deprecated/removed.
  • Escape output for HTML with htmlspecialchars.
  • For large datasets consider full-text search or dedicated search engines; prefix LIKE 'term%' can use an index, but LIKE '%term%' will not.
  • If this is for AJAX, return JSON and set proper headers; keep result limits to a reasonable number.

For PDO prepared-statement details see the PHP manual: PDO prepared statements.

Recommended Answers

All 2 Replies

Member Avatar for nikesh.yadav

only a litle change i m using switch u can use 'if '

<?php 

	$SQL_FROM = 'adr';
switdh($_request['radiobuttomname']){
case 'lastname':
	$SQL_WHERE = 'last';
case 'city:
        $SQL_WHERE = 'city';
and 
so on ....

?>
<?php
	$searchq		=	strip_tags($_GET['q']);
	$getRecord_sql	=	'SELECT * FROM '.$SQL_FROM.' WHERE '.$SQL_WHERE.' LIKE "'.$searchq.'%"';
	$getRecord		=	mysql_query($getRecord_sql);
	if(strlen($searchq)>0){

	echo '<ul>';
	while ($list = mysql_fetch_array($getRecord)) {?>
		<li><a href="runners2.php?name=<?php echo urlencode($list['first'].' '.$list['last']); ?>"><?php echo $list['last']; ?> <small><?php echo $list['first']; ?></small><small><?php echo $list['city']; ?></small><small><?php echo $list['age']; ?></small></a></li>
	<?php } 
	echo '</ul>';
	?>
<?php } ?>
Member Avatar for justinmyoung

I'm not sure how the if/else or switch statement would work if I'm attempting to use it with a radio button. The idea is to give the user an option between searching via a 'last name' or searching using 'city'. The name of the radio buttons are 'last' and 'city'. Would it be better to use switch or if, and what is the difference? Thanks

<?php 

	
	include('config.php'); 
	
	
	

	$SQL_FROM = 'adr';
	$SQL_WHERE = 'last';

?>
<?php
	$searchq		=	strip_tags($_GET['q']);
	$getRecord_sql	=	'SELECT * FROM '.$SQL_FROM.' WHERE '.$SQL_WHERE.' LIKE "'.$searchq.'%"';
	$getRecord		=	mysql_query($getRecord_sql);
	if(strlen($searchq)>0){
	// AJAX Response													
	echo '<ul>';
	while ($list = mysql_fetch_array($getRecord)) {?>
		<li><a href="runners2.php?name=<?php echo urlencode($list['first'].' '.$list['last']); ?>"><?php echo $list['last']; ?> <small><?php echo $list['first']; ?></small><small><?php echo $list['city']; ?></small><small><?php echo $list['age']; ?></small></a></li>
	<?php } 
	echo '</ul>';
	?>
<?php } ?>
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.