Adding a term to each item of a boolean query in PHP (reg exp?)

Question

On the browser side, the user will be entering a boolean query, which could grow complex, which I want to translate into an SQL SELECT statement.

The user will enter a text string, along the lines of a AND ((b OR c) OR (not d)) . As I said, this is an arbitrary text string, containing a boolean expression.

It's for a software recruiter, so a, b, c, d, etc will be skills, like C, C++, UML, Python, etc, so that the previous example might actually read C++ AND ((UML OR Python) OR (not Perl)) .

Which I want to expand to (in this case) SELECT * FROM candidates WHERE skill=C++ AND ((skill=UML OR skill=Python) OR (not skill=Perl)) .

I can prepend the SELECT statement, but how do I translate (eg) C++ AND ((UML OR Python) OR (not Perl)) to skill=C++ AND ((skill=UML OR skill=Python) OR (not skill=Perl)) and do it for any arbitrary boolean expression, with any number of brackets, in PHP?

Answer 1

I made the following observation from the example you posted: All you want to do is replace the tokens like C++ with a token of the form skill=C++ , the rest of the query is unchanged. If that is not always true, you might need a more complex solution, but if that's enough for you, the following should work:

$expr = 'C++ AND ((UML OR Python) OR (not Perl))';

// remove tokens that will not be replaced, here `(`, `)`, and `not`
$trimmed = str_replace(['(', ')', 'not'], ['', '', ''], $expr);

// split string based on the keywords `AND` and `OR` (case insensitive)
// keywords will also not be replaced
$tokens = preg_split('/AND|OR/i', $trimmed);

// create replacement tokens without leading/trailing whitespace
$replacementTokens = [];
foreach ($tokens as &$token) {
    $token = trim($token);
    $replacementTokens[] = "skill=$token";
}

// replace tokens and construct the query
$where = str_replace($tokens, $replacementTokens, $expr);
$query = "SELECT * FROM candidates WHERE $where";

As said, this solution might not work if you need more complex behaviour. You also might need to extend the keyword lists. But for the simple use case you provided, it avoids the need to actually parse the query.

On a final note, make sure that you sanitise your user inputs, so you're not susceptible to SQL injections.