如果仅选择一个过滤器，则过滤

Question

I have to make a car website that filters cars depending on a preset mysql database. I have got it to filter if all are selected (eg: Honda, white, petrol and not on special - it will show that car) but if I just wanted to see all the Honda's (for example) nothing shows.

This is the code I have:

if(isset($_GET['make']) || isset($_GET['colour']) || isset($_GET['fueltype']) ||          isset($_GET['special'])){

if(isset($_GET['make'])){
$make = $_GET['make'];
}

if(isset($_GET['colour'])){
$colour = $_GET['colour'];
}

if(isset($_GET['fueltype'])){
$fueltype = $_GET['fueltype'];
}

if(isset($_GET['special'])){
$special = $_GET['special'];
}

$result = mysqli_query($con,"SELECT * FROM Cars WHERE MAKE ='$make' AND COLOUR = '$colour' AND FUELTYPE = '$fueltype' AND SPECIAL = '$special'");
}



else{
$result = mysqli_query($con,"SELECT * FROM Cars");
}

the else statement makes all the cars show up when you open the page before filtering.

Answer 1

escape can mean: mysql_escape_string, check against a list of valid/allowed values, or whatever you want after good thinking.

$where = "";
$separator = " WHERE ";

if(isset($_GET['make'])){
    $make = $_GET['make'];
    !! escape here
    $where .= $separator . " MAKE = '$make' ";
    $separator = " AND ";
}

if(isset($_GET['colour'])){
    $colour = $_GET['colour'];
    !! escape here
    $where .= $separator . " COLOUR = '$colour' ";
    $separator = " AND ";
}

... 

$result = mysqli_query($con,"SELECT * FROM Cars " . $where);