Problem with search (SELECT WHERE)

[rkeppert]

Ok this is what i'm getting:

Parse error: syntax error, unexpected T_CONSTANT_ENCAPSED_STRING in /const/a_searchlist.php on line 23

Here is the code:

 $sql = "SELECT * FROM $tabname ORDER BY lastname WHERE lastname = '".$_POST['lastname']."%' AND firstname = '".$_POST['firstname']."%' AND dob = '".$_POST['dob']."%' AND warstatus = 'ACTIVE' OR warstatus = 'TRANSFERRED'";

I had to have screwed something up here, but just can't see it...

What I'm trying to do is have a search where it pulls records matching:

lastname (with % wildcard)

firstname (when the lastname matches, check this for a value if no value return all results in db when lastname matches)

dob (when the lastname matches, check this for a value if no value return all results in db when lastname matches)

and only display records based on the table field

warstatus (where the table field contains ACTIVE or TRANSFERRED)

Ok now that I am confused writing that, I hope it makes sense to someone... any other info let me know.

Thanks in advance

Rob

[Weedpacket]

 $sql = "SELECT * FROM $tabname ORDER BY lastname WHERE lastname = '".$_POST['lastname']."%' AND firstname = '".$_POST['firstname']."%' OR firstname = '""' AND dob = '".$_POST['dob']."%' OR dob = '""' AND warstatus = 'ACTIVE' OR warstatus = 'TRANSFERRED'";

What is

'""'

supposed to mean? Because right now what it means is "an apostrophe, then end the string, then start the string, then an apostrophe."

And do a search on the subject of "SQL injection".

[rkeppert]

sorry about that... must have been the kids distractions.... those were not intended to be there... and has been corrected in the above code...