dynamically generate sql query statement

Anon

I would like to consult if anyone has come across with any article that's regarding to dynamically generate sql query statement, like, SELECT, UPDATE, DELETE... etc. Or has anyone done that before?

If someone could shed a light on this, it's much appreciated.

Thank you.

Anon

Dynamically generating sql statements is quite simple.
The database functions in PH work with strings, so the sql statement can be a string stored in a variable....

in pseudo code:

$my_sql_statement = "select ";

if ($looking_for_column_a)
{
$my_sql_statement .=" column_a ";
}
else
{
$my_sql_statement .=" column_b ";
};

$my_sql_statement .= "from ".$table_to_search_in

$where = " where column_b=2";

$my_sql_statemenet .=$where;

mysq_query($my_sql_statement);

Anon

Has anyone got/seen/know of Javascript
code to interactively generate the sql
query and then fire it to a PHP script?
Tia....

-duke

Anon

Um.... why would you want to?

What's the difference between letting javascript make an sql statemant and pass it to PHP for processing and the form passing the elements of an sql statement to PHP for processing?

Anon

The site that I'm developing will only
search or input database. I want the SQL
to be "directed", i.e. originating
completely from combo boxes. If you visit
HP's site - the support pages, you'll
see that they do something similar. The choices are so many, that it makes sense to off-load the selection of options to the
browser and let JS send "hidden" variables
or one sql statement.

-duke

Anon

I'm thinking of doing an API layer for my applications to interact with database. That's why I thought to ask around if there's already exist API that I can refer to.

Thanks, Vincent for your help.

Anon

I see. Yes in case like that it does make sense.
But, I would only let javascript make the choices of the where statement,
not the whole query. Javascript can easily be hacked and one could submit a naughty query to your database.

Anon

Hi...

I see. Yes in case like that it does make sense.
But, I would only let javascript make the choices of the where statement,
not the whole query. Javascript can easily be hacked and one could submit a naughty query to your database.
[un-quote]

Good point! So reading between the lines --
if the potential hacker doesn't
know/realize what "table(s)" he is dealing
with, then he can't do any/much damage?

However, I still have my original problem --
anybody know of any JS code that will do
what I want, i.e. flash a bunch of combo
boxes that will end up putting together a
SQL query ( or parts of)? Thanks.

-duke

Anon

Hm... maybe you could have a look at how HP does it, just to get an idea of how to do it.

It would ofcourse be very naughty to copy their routines.