php - 使用 MySQL 和 PHP 搜索多个值的最有效方法

Question

我正在我的网站上创建一个搜索功能，该功能将在 phpvms_schedules 表中查找航类，并使用 HTML 表单和一些不同的搜索参数:

<form method="get" action="">
    <select name="code" value="<?php echo $_GET['code'];?>" required>
        <?php
            // select all airlines
            $query = mysql_query("SELECT * FROM phpvms_airlines WHERE enabled=1");
            // loop thru
            while($row = mysql_fetch_assoc($query)) {
        ?>
        <option value="<?php echo $row['code'];?>"><?php echo $row['name'];?></option>
        <?php
            } // end loop
        ?>
    </select><br /><br />
    <input type="text" name="depicao" maxlength="5" placeholder="Airport of Departure" value="<?php echo $_GET['depicao'];?>"><br />
    <input type="text" name="arricao" maxlength="5" placeholder="Airport of Arrival" value="<?php echo $_GET['arricao'];?>"><br />
    <input type="text" name="mindis" maxlength="5" placeholder="Minimum distance" value="<?php echo $_GET['mindis'];?>"><br />
    <input type="text" name="maxdis" maxlength="5" placeholder="Maximum distance" value="<?php echo $_GET['maxdis'];?>"><br />
    <input type="submit" name="submit" value="Search">
</form>

考虑到其中一些参数不会由用户填写，使用这些参数构建 MySQL 查询的最有效的代码方法是什么？

我试过SELECT * FROM phpvms_schedules WHERE code='$code' OR depicao='$depicao' OR arricao='$arricao' OR distance >= $mindis AND distance <= $maxdis但没有用。

Answer 1

这是我最终采用的解决方案:

// sanitise the user inputs
$code = strip_tags(mysql_real_escape_string($_GET['code']));
$depicao = strip_tags(mysql_real_escape_string($_GET['depicao']));
$arricao = strip_tags(mysql_real_escape_string($_GET['arricao']));
$mindis = strip_tags(mysql_real_escape_string($_GET['mindis']));
$maxdis = strip_tags(mysql_real_escape_string($_GET['maxdis']));

// start constructing the WHERE clause for the query
$WHERE = "enabled=1";

if(strlen($code)!=0) {
    $WHERE .= " AND code='$code'";
}
if(strlen($depicao)!=0) {
    $WHERE .= " AND depicao='$depicao'";
}
if(strlen($arricao)!=0) {
    $WHERE .= " AND arricao='$arricao'";
}
if(strlen($mindis)!=0) {
    $WHERE .= " AND distance >= $mindis";
}
if(strlen($maxdis)!=0) {
    $WHERE .= " AND distance <= $maxdis";
}

// query
$query = mysql_query("SELECT * FROM phpvms_schedules WHERE $WHERE");