Here's how I do it. I create a variable (string), lets call it $whereSQL, and a variable to keep track of how many fields are being matched, which will will call $whereCount.
There purpose of the $whereCount is to decide whether " and " is required. $whereCount is set to 0, then incremented each time I add a field to search for.
At each step, if the field is being searched, I check the $whereCount. If $whereCount > 0 then I add " and " to $whereSQL, followed by " field = 'value' ", then $whereCount++. If $whereCount = 0, then I don't add the " and ", because it is the first field in the list.
I can then make the sql string by doing "SELECT -fields- FROM -table- WHERE " . $whereSQL . " ORDER BY -field-".
Don't quote me on any of this code, I'm sure I have some typos in there or something, but that is the general idea behind one way to do it.
-Pete