How can i use SQL where clause with multiple if statements

Question

I have multiple if conditions with multiple where clauses is there at SQL queries.

if(empty($pincode) && !empty($data) && $flag==true ) {    
                 $dql = "SELECT s.instaffiliation,i.institutename,i.institutefeerange,i.instituterating,
                 a.addressline1,a.addressline2,i.instituterating,
                 i.instituteteachingtimings,s.instdescription,s.insttype,
                 s.insteligibilitycriteria,u.instlogo,u.instbrochure
                 FROM Edufaction\Bundle\EdufactionBundle\Entity\Institute i 
                 INNER JOIN i.instsummary s
                 INNER JOIN i.address a
                 INNER JOIN i.insturl u 
                 WHERE s.instaffiliation IN('')      
                 ORDER BY i.instituterating";       
       }
if(empty($pincode) && !empty($data) && $flag==false) {
                 $dql = "SELECT s.instaffiliation,i.institutename,i.institutefeerange,i.instituterating,
                 a.addressline1,a.addressline2,i.instituterating,
                 i.instituteteachingtimings,s.instdescription,s.insttype,
                 s.insteligibilitycriteria,u.instlogo,u.instbrochure
                 FROM Edufaction\Bundle\EdufactionBundle\Entity\Institute i 
                 INNER JOIN i.instsummary s
                 INNER JOIN i.address a
                 INNER JOIN i.insturl u 
                 WHERE s.instaffiliation IN($data)    
                 ORDER BY i.instituterating";         
       }
if(!empty($pincode) && !empty($data)) {
                $dql = "SELECT s.instaffiliation,i.institutename,i.institutefeerange,i.instituterating,
                 a.addressline1,a.addressline2,i.instituterating,
                 i.instituteteachingtimings,s.instdescription,s.insttype,
                 s.insteligibilitycriteria,u.instlogo,u.instbrochure
                 FROM Edufaction\Bundle\EdufactionBundle\Entity\Institute i 
                 INNER JOIN i.instsummary s
                 INNER JOIN i.address a
                 INNER JOIN i.insturl u 
                 WHERE s.instaffiliation IN($data)   
                 AND a.pincode IN($pincode)    
                 ORDER BY i.instituterating";                     
     }                     
if(!empty($data) && !empty($reqfee) && $flag==false) {
                 $dql = "SELECT s.instaffiliation,i.institutename,i.institutefeerange,i.instituterating,
                 a.addressline1,a.addressline2,i.instituterating,
                 i.instituteteachingtimings,s.instdescription,s.insttype,
                 s.insteligibilitycriteria,u.instlogo,u.instbrochure
                 FROM Edufaction\Bundle\EdufactionBundle\Entity\Institute i 
                 INNER JOIN i.instsummary s
                 INNER JOIN i.address a
                 INNER JOIN i.insturl u 
                 WHERE s.instaffiliation IN($data) 
                 AND i.institutefeerange IN($reqfee)   
                 ORDER BY i.instituterating";        
       }

Here query is same with multiple where conditions based on multiple if conditions. How can i apply single query with multiple where clauses at a time using if conditions. Please help me anyone. Thanks for advance

Answer 1

So it looks like you are just trying to simplify the code. If that is the case, you can do with simple concatenate of strings, but not really an exposure to sql injection. The primary list of fields and joins is all the same and so is the order by. So build the first part of the query into the string up to the where clause.

$dql = "SELECT 
              s.instaffiliation, i.institutename, i.institutefeerange,
              i.instituterating, a.addressline1, a.addressline2, 
              i.instituterating, i.instituteteachingtimings, s.instdescription, 
              s.insttype, s.insteligibilitycriteria, u.instlogo, u.instbrochure
          FROM 
              Edufaction\Bundle\EdufactionBundle\Entity\Institute i
                 INNER JOIN i.instsummary s
                 INNER JOIN i.address a
                 INNER JOIN i.insturl u
          WHERE ";

NOW, add the where criteria per the specific qualifying condition

if(empty($pincode) && !empty($data) && $flag==true )
{
   $dql = $dql + "s.instaffiliation IN('') ";
}
if(empty($pincode) && !empty($data) && $flag==false) 
{
   $dql = $dql + "s.instaffiliation IN($data)";
}
if(!empty($pincode) && !empty($data)) 
{
   $dql = $dql + "s.instaffiliation IN($data)   
                 AND a.pincode IN($pincode) ";
}
if(!empty($data) && !empty($reqfee) && $flag==false) 
{
   $dql = $dql + "s.instaffiliation IN($data) 
                 AND i.institutefeerange IN($reqfee) "; 
}

AND finally, tack on the order by clause

$dql = $dql + "ORDER BY i.instituterating";        

Is this closer to what you are trying to simplify in your code?

Answer 2

$query_string = "SELECT rows FROM table INNER JOIN ";

// Here you validate your variables and build your correct WHERE clause

if(empty($pincode) && !empty($data) && $flag==true ) {
    $query_string .= " WHERE s.instaffiliation IN('') ";
}

// and so on for every case

$query_string .= "ORDER BY row ASC ";

// Now you will have a sigle correct query string