javascript - Manipulate SQL query depending on the filters applied in PHP?

Solution:

You can try it this way:

$query = "SELECT Number, ID, Date, Log_Time, WorkID, Att_Type FROM Attendance";
$chosenwork = null;

if (isset($_POST['reqID'])){ #checks if the ID search input field (reqID) has been submitted
  $userid = $_POST['reqID'];
  $query .= " WHERE ID = ?";
  
} else{                                  
  $userid = $_SESSION['sess_user_id'];
  $query .= " WHERE ID = ?";
}

if (isset($_POST['chosenWork'])){ #checks if the dropdown for Workspace Number (chosenWork) has been selected
  $chosenwork = $_POST['chosenWork'];
  $query .= " WorkID = ?";
}

if (isset($_POST['chosenWork']) && isset($_POST['reqID'])){ #checks if both are selected
  $chosenwork = $_POST['chosenWork'];
  $userid = $_POST['reqID'];
  $query = "SELECT Number, ID, Date, Log_Time, WorkID, Att_Type FROM Attendance WHERE ID = ? AND WorkID = ?";
}

$query .= ";";
$stmt = $conn->prepare($query);
(isset($userid)) ?? $stmt->bind_param("i", $userid);
(isset($chosenwork)) ?? $stmt->bind_param("i", $chosenwork);
$stmt->execute();

$result = $stmt->setFetchMode(PDO::FETCH_ASSOC);
Copy code

Solution:

It is hard to help debug without more info, but several things I noticed:

1. Looking at the error, it says the problem is either syntax but it could be the result of an old version. Have you checked your sql version? Prepared statements were introduced in v4.1.

2. You haven't shown your html or js validation, but since you are telling sql to expect integers, are you absolutely sure your variables are integers? To be sure, add a 0 to $userid and $chosenwork (e.g.$userid = $userid + 0;) before binding them

3. For security, validating posted form data should be done on the server not client -- it is trivial to circumvent client-side js validation

4. The null coalescing operators in Serghei Leonardo's answer will only work if you are using php7 or higher. Also, I am not familiar with his usage of it so I may be wrong, but it looks to me it will return $userid and $chosenwork if they are set and only bind ifisset($userid) orisset($chosenwork) are null (i.e. if $userid or $chosenwork are null), which would be backwards from what you want. See another explanation here. This might not work, but try changing it to:

   (!isset($userid) ?? $stmt->bind_param("i", $userid));(!isset($chosenwork) ?? $stmt->bind_param("i", $chosenwork));