Building a dynamic query - leaving fields out?

[TangoGirl]

Guys,

I'm using the following code which I picked up here to create a dynamic SQL query:

$sql = "SELECT * FROM employees WHERE Status = 'Live' ";

while(list($key, $val) = each($HTTP_GET_VARS)) {
    $key = stripslashes($key); 
    $val = stripslashes($val);
    // print "$key / $val<br>";
	if ($val != "") {
      $sql .= "AND $key LIKE '%$val%' ";    

    }
}
$query_rsSearch = $sql;

I have to use the GET method and the first page of results is fine, but I'm using navigation links which send another GET variable in the URL which messes the query up (column not found in table).

So... question is, is there a simple way to tell the script to leave a variable out of the query. e.g. a variable called pageNum? Rather than having to define all the potential variables instead?

Hope his makes sense to someone!?

[cahva]

if ($val != "" || !strstr($key,'pageNum')) {
      $sql .= "AND $key LIKE '%$val%' ";    

    }

Should do the trick..

[cahva]

...But I would do exactly this like you didnt want to do. 🙂 Why? Because the surfers can add whatever they like in the URL and make the query broken.

[TangoGirl]

Noted... thanks cahva

[TangoGirl]

Hmmm... it's still putting pageNum into the where clause. Any ideas?

[TangoGirl]

I know it's not cool to answer your own question!!