过滤不过滤

Question

I am trying to make a filter for website of cars. I would like to be able to filter by color of car represented by exterior. I do this by Select Distinct from exterior colors to list all of the exterior colors.

<h6 class="text-info">Select Color</h6>
          <ul class="list-group">
            <?php
                $sql="SELECT DISTINCT exterior FROM newcars ORDER BY exterior";
                $result=$conn->query($sql);
                while($row=$result->fetch_assoc()) {
            ?>
          <li class="list-group-item">
            <div class="form-check">
              <label class="form-check-label">
                <input type="checkbox" class="form-check-input product_check" name="" value="<?= $row['exterior']; ?>" id="exterior"><?= $row['exterior']; ?>
              </label>
            </div>
          </li>
        <?php
          }
        ?>
          </ul>
  <div id="test">
        <?php
          $sql = "SELECT * FROM newcars";
          $result = mysqli_query($conn, $sql);
          if (mysqli_num_rows($result) > 0) {
            while ($row = mysqli_fetch_assoc($result)) {
                echo ("<a href='newcarindex.php?id={$row['id']}'><div class='car'>");
                echo '
                      <tr>
                        <td>
                        <img src="data:image\jpeg;base64,'.base64_encode($row['photo']).'"/>
                        </td>
                      </tr>
                ';
                echo "<h2 class=car-name>";
                echo $row['name'];
                echo "</h2>";
                echo "<span class=stock>STOCK#";
                echo $row['stock'];
                echo "</span>";
                echo "<h3 class=car-msrp>";
                echo $row['msrp'];
                echo "</h3>";
                echo "</div></a>";
            }
          } else {
            echo "There are no Comments!";
          }
        ?>
    </div> 

action.php this page i link to get the the results from what color they select. But I still cannot get it filter to the results.

  include 'dbh.php';

  if(isset($_POST['action'])) {
    $sql = "SELECT * FROM newcars WHERE class !=''";

    if(isset($_POST['class'])) {
      $class = implode("','", $_POST['class']);
      $sql .="AND class IN('".$class."')";
    }
    if(isset($_POST['body'])) {
      $body = implode("','", $_POST['body']);
      $sql .="AND class IN('".$body."')";
    }
    if(isset($_POST['exterior'])) {
      $exterior = implode("','", $_POST['exterior']);
      $sql .="AND class IN('".$exterior."')";
    }

    $result = $conn->query($sql);
    $output='';

    if($result->num_rows>0){
      while($row=$result->fetch_assoc()){
        $output .='<a href='newcarindex.php?id={$row['id']}'><div class='car'>
        <tr>
          <td>
          <img src="data:image\jpeg;base64,'.base64_encode($row['photo']).'"/>
          </td>
        </tr>
        <h2 class=car-name>'.$row['name'].'</h2>
        <span class=stock>STOCK#'.$row['stock'].'</span>
        <h3 class=car-msrp>'.$row['msrp'].'</h3>
        </div></a>'
      }
    } else {
      $output ="<h3>No Results</h3>";
    }
    echo $output;
  }
?>

Answer 1

First of all you need to wrap your checkboxes in a HTML form that will send data to action.php file:

<h6 class="text-info">Select Color</h6>
<form action="action.php">
    <ul class="list-group">
        <?php
            $sql = "SELECT DISTINCT exterior FROM newcars ORDER BY exterior";
            $result = $conn->query($sql);
            while($row=$result->fetch_assoc()) {
        ?>
            <li class="list-group-item">
                <div class="form-check">
                    <label class="form-check-label">
                        <input type="checkbox" class="form-check-input product_check" name="" value="<?= $row['exterior']; ?>" id="exterior"><?= $row['exterior']; ?>
                    </label>
                </div>
            </li>
        <?php
        }
        ?>
    </ul>
    <input type="submit" value="Filter" />
</form>
<div id="test">
...

Then, in action.php file you need to revise your SQL query. At this moment, when you concatenate base $sql variable with the one from if(isset($_POST['exterior'])) condition, the query looks like:

SELECT * FROM newcars WHERE class !=''AND class IN( ...

making it invalid (notice no space between !='' and AND).

Then the while loop has mixed apostrophes and quotation marks, which makes PHP code invalid. It should look like this:

while($row=$result->fetch_assoc()){
    $photo = base64_encode($row['photo']);
    $output .= "<a href='newcarindex.php?id={$row['id']}'>
        <div class='car'>
            <tr>
                <td>
                    <img src='data:image\jpeg;base64,{$photo}'/>
                </td>
            </tr>
            <h2 class='car-name'>{$row['name']}</h2>
            <span class='stock'>STOCK#{$row['stock']}</span>
            <h3 class='car-msrp'>{$row['msrp']}</h3>
        </div></a>";
}