PHP/MYSQL Query - error response

jarow

I am getting the following error response:

You have an error in your SQL syntax near 'LIKE '%varphylum%' AND clase LIKE '%varclase%' AND orden LIKE '%varord%' AND fam' at line 1

for the following code:

require_once('../Connections/connfauna.php'); 

mysql_select_db($database_connfauna, $connfauna);
$query_rsadd = "SELECT * FROM fauna";
if(isset($_GET['phylum'])){   

    $varphylum = $_GET['phylum'];
    $query_rsadd .="WHERE phylum LIKE '%varphylum%'";
if(isset($_GET['clase'])){
      $varclass = $_GET['clase'];
      $query_rsadd .=" AND clase LIKE '%varclase%'";
if(isset($_GET['orden'])){
        $varord = $_GET['orden'];
        $query_rsadd .=" AND orden LIKE '%varord%'";
if(isset($_GET['familia'])){
          $varfam = $_GET['familia'];
          $query_rsadd .=" AND familia LIKE '%varfam%'";
if(isset($_GET['genero'])){
            $vargen = $_GET['genero'];
            $query_rsadd .=" AND genero LIKE '%vargen%'";    

          }    

        }        

      }    

    }
}
$rsadd = mysql_query($query_rsadd, $connfauna) or die(mysql_error());
$row_rsadd = mysql_fetch_assoc($rsadd);
$totalRows_rsadd = mysql_num_rows($rsadd);

Any ideas why the error message?

laserlight

imagine your concatenated strings forming your query.

For example:
SELECT * FROM faunaWHERE phylum LIKE '%varphylum%'

you seem to have missed the first space

jarow

Thanks for the response...you were correct...no space between fauna and WHERE..
After I corrected that I got no error response but neither did any of the values post in the echos.

Does anything occur to you why that might be? Here's the entire page:
(By the way the method of the form that posts to this page is GET)

<?php require_once('../Connections/connfauna.php'); ?>
<?php
mysql_select_db($database_connfauna, $connfauna);
$query_rsadd = "SELECT * FROM fauna";
if(isset($_GET['phylum'])){   

    $varphylum = $_GET['phylum'];
    $query_rsadd .=" WHERE phylum LIKE '%varphylum%'";
if(isset($_GET['clase'])){
      $varclass = $_GET['clase'];
      $query_rsadd .=" AND clase LIKE '%varclase%'";
if(isset($_GET['orden'])){
        $varord = $_GET['orden'];
        $query_rsadd .=" AND orden LIKE '%varord%'";
if(isset($_GET['familia'])){
          $varfam = $_GET['familia'];
          $query_rsadd .=" AND familia LIKE '%varfam%'";
if(isset($_GET['genero'])){
            $vargen = $_GET['genero'];
            $query_rsadd .=" AND genero LIKE '%vargen%'";    

          }    

        }        

      }    

    }
}
$rsadd = mysql_query($query_rsadd, $connfauna) or die(mysql_error());
$row_rsadd = mysql_fetch_assoc($rsadd);
$totalRows_rsadd = mysql_num_rows($rsadd);

?>
<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body>
<p><?php echo $row_rsadd['phylum']; ?> </p>
<p><?php echo $row_rsadd['clase']; ?></p>
<p> <?php echo $row_rsadd['orden']; ?> </p>
<p><?php echo $row_rsadd['familia']; ?> </p>
<p><?php echo $row_rsadd['genero']; ?> </p>
<p><?php echo $row_rsadd['especie']; ?> </p>
</body>
</html>?>

Any ideas would be most appreciated

laserlight

hehe, I probably should have pointed this out earlier, but it didnt quite click in my mind:

$varphylum = $_GET['phylum'];
$query_rsadd .=" WHERE phylum LIKE '%varphylum%'";

should be:
$varphylum = $_GET['phylum'];
$query_rsadd .= " WHERE phylum LIKE '%$varphylum%'";

actually, you might want to escape $_GET['phylum'] first, e.g. by using addslashes() if magic_quotes_gpc != 1

jarow

That worked! HOWEVER, my query is not doing what I hoped it would do.

You have been so helpful and I don't want to impose on you anymore than I have but if you are willing I have two more questions.

How should my query be written to do the following. I have a form that posts to the page with the query...the form has five fields
Phylum
Clase
Orden
Familia
Genero

What I want is that if the user only fills in the phylum field, only the phylum result will be shown. If the user fills in the phylum and class field, again, only those two results are shown. However if the user fills in let's say the genero field than that field and all the fields above it are shown. In other words, I need the query to display the chosen field and all those above it even if the fields above the chose field have not been filled in. Am I explaining that clearly?

And the second question is
2. could you show me one example of what you mean by "escaping $_GET['phylum'] first, e.g. by using addslashes() if magic_quotes_gpc != 1"

Don't feel obliged to do any of these but please know you have been extremely helpful

regards

Jim