Q:

Setup mysql query with dynamic datasets per section

Ok, so my main issue is with anything that goes between WHERE and ORDER BY, LIMIT, etc.
I have it currently setup like the below:
SELECT " . $column_string . " FROM " . $table_name . " " . $query_join . " " . $where . " " . $query_end . " " . $query_limit

My issue is this, I have it setup to check each variable with escape string but when you come to $query_end which would hold test = '1' AND test2 = '2' etc. I have that section setup to allow you to send the whole string in one go. But of course if you check that it gets turned into test = \'1\' AND test2 = \'2\'.
The only thing I could think of doing was seperating it into some wierd array like [test2 = ],[2] but that doesn't work for (test1 = '2' OR test2 = '3') although I could make it work I really don't want to do it that way.
Can anyone suggest a better solution to the above problem? Also is there another item for checking for injection outside of mysql-real-escape-string?
The whole reason for this setup is to allow me to send multiple queries via ajax using json and then sending all the data back in a 3 level array.

A:

Nothing actually wrong with "weird" array.
Every custom search solution is based on the similar approach - a series of conditions to assembly a WHERE clause dynamically.
I have no idea though, why would you need a fieldset or a table set by a user. But the idea would be quite the same. Just don't forget to verify all the identifiers and operators against a hardcoded white list.

