adding a condition on WHERE clause of a multi lined query

Question

I have a ajax query with multiple lines and I want the query to show only results that have an "active" status

$query .= "SELECT * FROM students ";
if(isset($_POST["search"]["value"]))
{
 $query .= 'first_name LIKE "%'.$_POST["search"]["value"].'%" ';
 $query .= 'OR last_name LIKE "%'.$_POST["search"]["value"].'%" ';

The second and third query is for when the user use the search box,

and I want the searchbox to also show only the "active" ones

I tried doing these to no avail

$query .= "SELECT * FROM students WHERE status='active' AND ";
if(isset($_POST["search"]["value"]))
{
 $query .= 'first_name LIKE "%'.$_POST["search"]["value"].'%" ';
 $query .= 'OR status='active' AND last_name LIKE "%'.$_POST["search"]["value"].'%" ';

$query .= "SELECT * FROM students";
if(isset($_POST["search"]["value"]))
{
 $query .= 'first_name LIKE "%'.$_POST["search"]["value"].'% && status='active' ';
 $query .= 'OR last_name LIKE "%'.$_POST["search"]["value"].'% && status='active' ';

Does this answer your question? [How can I prevent SQL injection in PHP?](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Alon Eitan, Jun 23 '20 at 07:11
unfortunately, no. What I'm trying to do is show results through Ajax Query not insert data. — bae, Jun 23 '20 at 07:12
You didn't ask about that, but using prepared statement will make your code secure and also solve this problem (And you need to escape the `'` using `\'`) — Alon Eitan, Jun 23 '20 at 07:12
@bae Read [this tutorial](https://websitebeaver.com/prepared-statements-in-php-mysqli-to-prevent-sql-injection) — Alon Eitan, Jun 23 '20 at 07:28

Hitesh Tripathi · Accepted Answer · 2020-06-23T08:26:19.380

It is good to use prepared statements instead of it.below code just solve your problem but it is good to use prepared statements

Put AND in side if condition

 $query = "SELECT * FROM students WHERE status='active'";
    if(isset($_POST["search"]["value"])){
          $query .= 'AND ( first_name LIKE "%'.$_POST["search"]["value"].'%" 
                     OR last_name LIKE "%'.$_POST["search"]["value"].'%")';
    }

adding a condition on WHERE clause of a multi lined query

1 Answers1