building query string (mysql + URL)

how to build query string from a large form

[coder1]

I have large form with 11 dropdown list 2 radio buttons, the user can select combination of the above form variables.

I have radio button group for transtype which can be either resale or new for which resale is preselected, other its up to the user to select whatever they like.

currently I building a query string for mysql query
1)

<?php
$searchstring = 'select * from mytable where category ='category'';

//this from dropdown list

if($_POST["producttype"]!="") {
$searchstring=$searchstring.' and `producttype` = \''.$_POST["producttype"].'\'';
}

//radio button

if (strcmp($_POST["transtype"],"resale")){
$searchstring=$searchstring.' and `salestatus`=0';

}
if (strcmp($_POST["transtype"],"new")){
$searchstring=$searchstring.' and `salestatus`=-1';

}

?>

there a better way of building query string then the above method, as the user can select combination of dropdownlist or radio buttons.

2) How then go building a URL from the above.

thanks in advance.

[PHP_Chimp]

Whenever you send anything to the database you should pass it through mysql_real_escape_string. As by altering the source code then submitting your page it would be possible to put anything into $searchstring=$searchstring.' and `producttype` = \''.$_POST["producttype"].'\'';.

To build your url you could use something like:

<?php
// connect to database
$searchstring = 'select * from mytable where category ='category'';
//this from dropdown list
if($_POST["producttype"]!="") {
$prod = mysql_real_escape_string($_POST["producttype"]);
$searchstring=$searchstring.' and `producttype` = \''.$prod.'\'';
}
//radio button
switch ($_POST['transtype']) { // dont know why you were using strcmp...so you may have to add that back in.
case 'resale':
$sale_status = 0;
break;
case 'new':
$sales_status = -1;
break;
}
$searchstring=$searchstring.' and `salestatus`='.$sales_status;
$url = "http://example.com/page.php?salesstatus=$sales_status;producttype=$prod";
?>

There is no error handling in the code. So what if there is no transtype, or no producttype?