I'm having a bit of a brain fart on this one. I'm working on some code that resembles a custom search form. The custom search form, is a mixture of checkboxes as well as some drop downs. All of the fields which are being searched for are also custom fields. The custom fields were entered through a custom write panel. Some of the fields are single values others are serialized fields.
The current code works, but i'm not sure if should be taking another approach, i'm not looking for anyone to write code for me. I'm just looking for some ideas on how this could be better.
$city = $_REQUEST['sCity']; $activity = $_REQUEST['sActivity']; $riverSegment = $_REQUEST['sRiverSegment']; $topicOfInterest = $_REQUEST['sTopicOfInterest']; $querystr = " SELECT DISTINCT wp_posts.* FROM wp_posts, wp_postmeta WHERE ( wp_posts.ID = wp_postmeta.post_id AND wp_postmeta.meta_key = 'city' AND wp_postmeta.meta_value = '$city' ) OR ( wp_posts.ID = wp_postmeta.post_id AND wp_postmeta.meta_key = 'riverSegment' AND wp_postmeta.meta_value = '$riverSegment' ) OR ( wp_posts.ID = wp_postmeta.post_id AND wp_postmeta.meta_key = 'topicOfInterest' AND wp_postmeta.meta_value LIKE '%$topicOfInterest%' ) OR ( wp_posts.ID = wp_postmeta.post_id AND wp_postmeta.meta_key = 'activity' AND wp_postmeta.meta_value LIKE '%$activity%' ) AND wp_posts.post_status = 'publish' AND wp_posts.post_type = 'sites' ORDER BY wp_posts.post_date DESC";
I feel like the above sample is flawed because if the first condition finds a match it will ignore the rest of the conditions.
Side Note: If i'm working with $wpdb->get_results(); should i still be escaping the user input to keep it clean?