Data retrival from SQL table using PHP & HTML5

Question

I have made a website of a Toy library using HTML5, CSS3 for main page and SQL to maintain database on server. On the main page there are two forms. One is to put available toys to rent, to which when data added, the actual data is being added to SQL database on server. The problem is when I need to fetch data from SQL, I have four drop down options on form. City, type of toy, age group and availability. User can select any combination of 4 options. If matching toy is available data should show up.

I have following code

try
    {
        $dbh = new PDO("mysql:host=localhost; dbname=***", "***", "***");
    }
    catch (Exception $e)
    {
        die('<p style="color:red">Could not connect to DB: ' . $e->getMessage() . '</p></body></html>');
    }

    if (isset($_POST["ownercity"]))         
    {
        $city = $_POST["ownercity"];       //Asker's preferable city
        $command = "SELECT * FROM Toys WHERE City=?";
        $stmt = $dbh->prepare($command);        
        $stmt->execute(array($city));

        if (isset($_POST["ownertoytype"])) 
        {            
            $type = $_POST["ownertoytype"];  //Asker's preferable toy type
            $command = "SELECT * FROM Toys WHERE City=? AND Type=?";
            $stmt = $dbh->prepare($command);        
            $stmt->execute(array($city,$type));

            if (isset($_POST["agegroup"]))
            {
                $goodage = $_POST["agegroup"];    //Asker's age group preference 
                $command = "SELECT * FROM Toys WHERE City=? AND Type=? AND Agegroup=?";
                $stmt = $dbh->prepare($command);        
                $stmt->execute(array($city,$type,$goodage));

                if (isset($_POST["ownerweek"]))
                {
                    $availability = $_POST["ownerweek"];//Asker's preference for availability
                    $command = "SELECT * FROM Toys WHERE City=? AND Type=? AND Agegroup=? AND Availability=?";
                    $stmt = $dbh->prepare($command);        
                    $stmt->execute(array($city,$type,$goodage,$availability));
                }
            }
        }
    }


    $row1 = $stmt->fetch();
    if($row1)
    {
        while($row1 = $stmt->fetch())                
        {
        echo "<h2 id='general'>"."Congratulations! Matching toys are available, Contact owners directly!"."</h2>";
        echo "<table class='toy' id='available'><tr><th>City</th><th>Type</th>
            <th>Age Group</th><th>Name</th><th>Email</th><th>Phone</th>
            </tr>";
        echo "<tr><td>".($row1['City'])."</td>";
        echo "<td>".($row1['Type'])."</td>";
        echo "<td>".($row1['Agegroup'])."</td>";
        echo "<td><b>".($row1['Name'])."</b></td>";
        echo "<td><b>".($row1['Email'])."</b></td>";
        echo "<td><b>".($row1['Phone'])."</b></td></tr>";
        echo "</table>";           
        }            
   }
    else 
    {
      echo "<h2 id='general'>"."Sorry! No matching toys are available, please try again later"."</h2>";
    }

Right now whatever choice is set, it shows up no matching toys are available even though there is.

What is wrong in my code?

Thanks

Answer 1

You probably need to look up valid syntax for SQL.

SELECT * FROM Toys WHERE City=?,Type=?,Agegroup=?

Here, you're assuming a comma is a valid conjunction. It isn't. Valid ones include AND and OR .

If you want to find the rows from Toys where one or more of your criteria are met, use this query.

SELECT *
  FROM Toys
 WHERE (City=? OR Type=? OR Agegroup=?)

It's good practice to enclose sequences of OR clauses in parentheses.

Answer 2

First thing, as Ollie says, in the queries you have to use AND and OR instead of , . There is also a problem with a code itself. Those fields will always be set so you should check if they are empty in the if statements.

if (isset($_POST['fieldname']) && trim($_POST['fieldname']))