PHP PDO prepare query issue

Question

The below works as long as the two fields are selected. If neither are selected it works, however my issue is when only one of the fields is selected, it doesn't work. It throws the unbound parameters issue.

I've tried setting a false value of 0 to both of the variables, however that won't work because then the query would be select from where = 0.

Ideas?

public static function searchProfile($status, $fundamt)
    {
        $database = DatabaseFactory::getFactory()->getConnection();
        $sql = "SELECT profile_id, profile_name, profile_url, finance_fundingtype, finance_equitypercent, finance_loanrate, finance_loanlength, finance_fundingamount, info_tradingstatus, info_elevatorpitch, info_patentable, info_industry, info_industry1, info_industry2, info_industry3, info_industry4, seeker_logo_url FROM profile_seeker WHERE profile_status = '1' ";

        if ($status) {
        $sql .= "AND info_tradingstatus IN (:status) ";
        }
        if ($fundamt) {
            $sql .= "AND finance_fundingamount <= :fundamt ";
        }

        $query = $database->prepare($sql);
        $query->execute(array(':status' => $status, ':fundamt' => $fundamt));
        $profiles = array();
$profiles[$profile->profile_id] = new stdClass();
            $profiles[$profile->profile_id]->profile_id = $profile->profile_id;
            $profiles[$profile->profile_id]->profile_name = $profile->profile_name;
            $profiles[$profile->profile_id]->profile_url = $profile->profile_url;
            $profiles[$profile->profile_id]->finance_fundingtype = $profile->finance_fundingtype;
            $profiles[$profile->profile_id]->finance_equitypercent = $profile->finance_equitypercent;
            $profiles[$profile->profile_id]->finance_loanrate = $profile->finance_loanrate;
            $profiles[$profile->profile_id]->finance_loanlength = $profile->finance_loanlength;
            $profiles[$profile->profile_id]->finance_fundingamount = $profile->finance_fundingamount;
            $profiles[$profile->profile_id]->info_tradingstatus = $profile->info_tradingstatus;
            $profiles[$profile->profile_id]->info_elevatorpitch = $profile->info_elevatorpitch;
            $profiles[$profile->profile_id]->info_patentable = $profile->info_patentable;
            $profiles[$profile->profile_id]->info_industry = $profile->info_industry;
            $profiles[$profile->profile_id]->info_industry1 = $profile->info_industry1;
            $profiles[$profile->profile_id]->info_industry2 = $profile->info_industry2;
            $profiles[$profile->profile_id]->info_industry3 = $profile->info_industry3;
            $profiles[$profile->profile_id]->info_industry4 = $profile->info_industry4;
            $profiles[$profile->profile_id]->seeker_logo_url = $profile->seeker_logo_url;
        }
        return $profiles;

Answer 1

You could try to check if the variables are set and that they hold a value that is not 0 and this has a string length longer than 0:

if (isset($status) && $status !== 0 && strlen($status) > 0) {
  $sql .= "AND info_tradingstatus IN (:status) ";
}
if (isset($fundamt) && $fundamt!== 0 && strlen($fundamt) > 0) {
  $sql .= "AND finance_fundingamount <= :fundamt ";
}

You could also try to bind the parameters manually:

$query = $database->prepare($sql);
if (isset($status) && $status !== 0 && strlen($status) > 0) {
  $query ->bindParam(':status',$status);
}
if (isset($fundamt) && $status !== 0 && strlen($fundamt) > 0) {
  $query ->bindParam(':fundamt',$fundamt);
}  
$query->execute();

Answer 2

Your binding error comes because you forgot to use the same if exists statement on your bindings.

Change this...

    if ($status) {
    $sql .= "AND info_tradingstatus IN (:status) ";
    }
    if ($fundamt) {
        $sql .= "AND finance_fundingamount <= :fundamt ";
    }

and

        $profiles[$profile->profile_id]->finance_fundingamount = $profile->finance_fundingamount;
        $profiles[$profile->profile_id]->info_tradingstatus = $profile->info_tradingstatus;

To this...

    if (isset($status) && $status != '') {
    $sql .= "AND info_tradingstatus IN (:status) ";
    }
    if (isste($fundamt) && $fundamt != '') {
        $sql .= "AND finance_fundingamount <= :fundamt ";
    }

and

        if (isset($status) && $status != '') {
        $profiles[$profile->profile_id]->finance_fundingamount = $profile->finance_fundingamount;
        }
        if (isste($fundamt) && $fundamt != '') {
        $profiles[$profile->profile_id]->info_tradingstatus = $profile->info_tradingstatus;
        }

This will stop the binding if one or both of the text boxes are empty.

Happy coding!