1: Don't use add_slashes, it's not hack proof. Use mysql_escape_whatever functions (lookemup, each db has its own) they are safe.
2: Is it acceptable to NOT have any where clause on this application? For some apps that's fine, for others, with say 100,000,000 records, it's just not acceptable to NOT have a where clause. This will determine how you write your application code.
3: Assuming that no where clause is ok, then you can't just assume to have one in your query.
Here's some code, not guaranteed to work exactly, but you'll get the idea:
<?php
if($_GET['county'] != "none"){
// Filter results by county
$query[] = "county='".mysql_real_escape($_GET['county'])."'"; # Not sure of the function name. it's something like that
if($_GET['price'] != "none"){
// Filter results by cost
$query[] = "price='".mysql_real_escape($_GET['price'])."'";
}
if($_GET['restname'] != "none"){
// Filter results by name
$query[] = "restname='".mysql_real_escape$_GET['restname'])."'";
}
$q = "select * from table ";
if (count($query)>0){
$q.="where ";
$q.=implode(" AND ",$query);
}
?>