[RESOLVED] SQL query

[mikawhat]

I've got the following query which gets values $search and $furn from a form.

SELECT * FROM properties WHERE description LIKE '%$search%' AND furniture='$furn' ORDER BY id ASC LIMIT $start, $display"

This works almost fine. The only problem is that because $furn value is either 'yes' or 'no', selected from a drop down menu, sometimes when is not selected the query doesn't work.

<select name="furnitured">
   <option value="" selected></option>
   <option value="Yes">Yes</option>
   <option value="No">No</option>
</select>

My question is what value i should give so that the query will search for both yes and no. I've tried % and * but it didn't work...

[tomhath]

I didn't test this, but it should work. By the way, it appears you are letting the user type in the search criteria, so read up on what's called an SQL Injection Attack. You'll need to "untaint" the $search variable before you use it here.

SELECT * FROM properties
WHERE description LIKE '%$search%' AND (furniture = '$furn' OR '$furn' = '')
ORDER BY id ASC LIMIT $start, $display"

[mikawhat]

Great! It works!
I know enough about the SQL injection and i could use something to reject queries with ' or " etc, but i think the host company has their own protection.
Thanx for your help! 😉