handling multiple search queries with php/mysql

Question

i building a car dealership portal, there are multiple dropdown in my search form, the issue i am facing is once a user performs a search instead of displaying what the user searched for, everything is displayed from the db.

i seriously can't point where i am getting it wrong. i would really appreciate if someone cant please look at it and help me out.

the form page is below.

<script>
function populate(s1,s2){
    var s1 = document.getElementById(s1);
    var s2 = document.getElementById(s2);
    s2.innerHTML = "";
    if(s1.value == "Honda"){
        var optionArray = ["accord|Accord","pilot|Pilot","crv|CRV"];
    } else if(s1.value == "Toyota"){
        var optionArray = ["corolla|Corolla","camry|Camry","highlander|Highlander"];
    } else if(s1.value == "Peugeot"){
        var optionArray = ["206|206","307|307"];
    }
    for(var option in optionArray){
        var pair = optionArray[option].split("|");
        var newOption = document.createElement("option");
        newOption.value = pair[0];
        newOption.innerHTML = pair[1];
        s2.options.add(newOption);
    }
}
</script>


<form action="test2.php" method="get" name="search">


<select name="bodytype">
  <option value="Saloon">Saloon</option>
  <option value="SUV">SUV</option>
</select>

<select name="make" id="make"  onchange="populate(this.id, 'model')">
 <option selected>Any</option>
                             <option value="Toyota">Toyota</option>
                             <option value="Honda">Honda</option>
                             <option value="BMW">BMW</option>
</select>


<select name="model"  id="model">

</select>


<select name="cost1">
                                                <option selected>Any</option>
                                                <option>10000</option>
                                                <option>20000</option>
                                                <option>30000</option>
                                                <option>40000</option>
                                                <option>50000</option>
                                                <option>60000</option>
                                                <option>70000</option>
                                                <option>80000</option>
                                                <option>90000</option>
                                                <option>100000</option>
                                          </select>


                                          <select name="cost2">
                                                <option selected>Any</option>
                                                <option>10000</option>
                                                <option>20000</option>
                                                <option>30000</option>
                                                <option>40000</option>
                                                <option>50000</option>
                                                <option>60000</option>
                                                <option>70000</option>
                                                <option>80000</option>
                                                <option>90000</option>
                                                <option>100000</option>
                                          </select>


<select name="transmission">
                                                <option selected>Any</option>
                                                <option>Auto</option>
                                                <option>Manual</option>

                                          </select>


<input name="submit" type="submit">


</form>

here is the form processing page

include('functions/config.php'); 
    if(isset($_GET['submit'])){






  $query = "SELECT * FROM details WHERE 1=1"; // Grab All Records
if ( isset($_GET["bodytype"]) ) 
   $query = $query . " AND bodytype = '%".$_GET["bodytype"]."%'"; // Filter on Body Type
if ( isset($_GET["make"]) ) 
   $query = $query . " AND make = '%".$_GET["make"]."%'"; // Filter on Make
   if ( isset($_GET["model"]) ) 
   $query = $query . " AND model = '%".$_GET["model"]."%'"; // Filter Model
   if ( isset($_GET["transmission"]) ) 
   $query = $query . " AND transmission = '%".$_GET["transmission"]."%'"; // Filter on Transmission




                                $search_query = mysqli_query($connection, $query);
                                if(!$search_query){

                                die("QUERY FAILED" .mysqli_error($connection));
                                                    }       

                                                    $count = mysqli_num_rows($search_query);

                                                    if($count == 0){

                                                            echo "no result";
                                                    }else{

                                                    while($row = mysqli_fetch_assoc($search_query)){
                                                    echo $row["bodytype"]."</br>";
                                                    echo $row["make"]."</br>";
                                                    echo $row["model"]."</br>";
                                                    /*echo $row["MinPrice"]."</br>";
                                                    echo $row["MaxPrice"]."</br>";*/
                                                    echo $row["transmission"]."</br>"; 

                                                    }



                                                    }



}

?>

Answer 1

If one of these get[] are blank parameters it'll return true for that field assuming the field isn't null because the like '%%' will be true.

You only want to do the like statement on the get parms that have data.

This would be the most consistent syntax, but I recommend SQL Injection updates also which are not listed.

Note that I changed your filter from OR to And

$query = "SELECT * FROM details WHERE 1=1"; // Grab All Records
if ( isset($_GET["bodytype"]) ) 
   $query = $query . " AND bodytype = '%".$_GET["bodytype"]."%'"; // Filter on Body Type
if ( isset($_GET["make"]) ) 
   $query = $query . " AND make = '%".$_GET["make"]."%'"; // Filter on Make

...