Limiting search results to show results based off of entry in a catgory.

Question

I am working of someones previous search query, and now the company wants it to be more limited to what is viewed.  I have multiple users in a database and each user has a state assigned to them. I do not want the user when doing a search, to have the results comeback and show all results for every state. The States are defined in the database category as follows. IL, IA, FL, NV.  There will never be anything in this category but these. Below is the code that I am trying to modify to limit the result to the specific state they are using. This is current page for searching in IA. What do I need to change so it will search all search terms, but limit the results to only show for that state.  Thanks in advance.
<?php require_once('../Connections/forms.php'); ?>
<?php include('inc_auth.php') ?>
<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
  $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);
  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;   
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  return $theValue;
$colname_subcat3 = "-1";
if (isset($_GET['Category'])) {
  $colname_subcat3 = (get_magic_quotes_gpc()) ? $_GET['Category'] : addslashes($_GET['Category']);
$colname1_subcat3 = "-1";
if (isset($_GET['SubCat1'])) {
  $colname1_subcat3 = (get_magic_quotes_gpc()) ? $_GET['SubCat1'] : addslashes($_GET['SubCat1']);
$colname2_subcat3 = "-1";
if (isset($_GET['SubCat2'])) {
  $colname2_subcat3 = (get_magic_quotes_gpc()) ? $_GET['SubCat2'] : addslashes($_GET['SubCat2']);
$colname3_subcat3 = "-1";
if (isset($_GET['SubCat3'])) {
  $colname3_subcat3 = (get_magic_quotes_gpc()) ? $_GET['SubCat3'] : addslashes($_GET['SubCat3']);
mysql_select_db($database_forms, $forms);
$query_subcat3 = sprintf("SELECT * FROM `forms` WHERE Category = %s and SubCat1 = %s and SubCat2 = %s and SubCat3 = %s ORDER BY Description ASC", GetSQLValueString($colname_subcat3, "text"),GetSQLValueString($colname1_subcat3, "text"),GetSQLValueString($colname2_subcat3, "text"),GetSQLValueString($colname3_subcat3, "text"));
$subcat3 = mysql_query($query_subcat3, $forms) or die(mysql_error());
$row_subcat3 = mysql_fetch_assoc($subcat3);
$totalRows_subcat3 = mysql_num_rows($subcat3);
$colname_category = "-1";
if (isset($_GET['Category'])) {
  $colname_category = (get_magic_quotes_gpc()) ? $_GET['Category'] : addslashes($_GET['Category']);
mysql_select_db($database_forms, $forms);
$query_category = sprintf("SELECT * FROM `forms` WHERE Category = %s ", GetSQLValueString($colname_category, "text"));
$category = mysql_query($query_category, $forms) or die(mysql_error());
$row_category = mysql_fetch_assoc($category);
$totalRows_category = mysql_num_rows($category);
$colname_subcat1 = "-1";
if (isset($_GET['Category'])) {
  $colname_subcat1 = (get_magic_quotes_gpc()) ? $_GET['Category'] : addslashes($_GET['Category']);
$colname1_subcat1 = "-1";
if (isset($_GET['SubCat1'])) {
  $colname1_subcat1 = (get_magic_quotes_gpc()) ? $_GET['SubCat1'] : addslashes($_GET['SubCat1']);
mysql_select_db($database_forms, $forms);
$query_subcat1 = sprintf("SELECT * FROM `forms` WHERE Category = %s and SubCat1 = %s ORDER BY Description ASC", GetSQLValueString($colname_subcat1, "text"),GetSQLValueString($colname1_subcat1, "text"));
$subcat1 = mysql_query($query_subcat1, $forms) or die(mysql_error());
$row_subcat1 = mysql_fetch_assoc($subcat1);
$totalRows_subcat1 = mysql_num_rows($subcat1);
$colname_subcat2 = "-1";
if (isset($_GET['Category'])) {
  $colname_subcat2 = (get_magic_quotes_gpc()) ? $_GET['Category'] : addslashes($_GET['Category']);
$colname1_subcat2 = "-1";
if (isset($_GET['SubCat1'])) {
  $colname1_subcat2 = (get_magic_quotes_gpc()) ? $_GET['SubCat1'] : addslashes($_GET['SubCat1']);
$colname2_subcat2 = "-1";
if (isset($_GET['SubCat2'])) {
  $colname2_subcat2 = (get_magic_quotes_gpc()) ? $_GET['SubCat2'] : addslashes($_GET['SubCat2']);
mysql_select_db($database_forms, $forms);
$query_subcat2 = sprintf("SELECT * FROM `forms` WHERE Category = %s and SubCat1 = %s and SubCat2 = %s ORDER BY Description ASC", GetSQLValueString($colname_subcat2, "text"),GetSQLValueString($colname1_subcat2, "text"),GetSQLValueString($colname2_subcat2, "text"));
$subcat2 = mysql_query($query_subcat2, $forms) or die(mysql_error());
$row_subcat2 = mysql_fetch_assoc($subcat2);
$totalRows_subcat2 = mysql_num_rows($subcat2);
$colname_subcat4 = "-1";
if (isset($_POST['searchbox'])) {
  $colname_subcat4 = (get_magic_quotes_gpc()) ? $_POST['searchbox'] : addslashes($_POST['searchbox']);
$colname6_subcat4 = "-1";
if (isset($_POST['searchbox'])) {
  $colname6_subcat4 = (get_magic_quotes_gpc()) ? $_POST['searchbox'] : addslashes($_POST['searchbox']);
$colname1_subcat4 = "-1";
if (isset($_POST['searchbox'])) {
  $colname1_subcat4 = (get_magic_quotes_gpc()) ? $_POST['searchbox'] : addslashes($_POST['searchbox']);
$colname2_subcat4 = "-1";
if (isset($_POST['searchbox'])) {
  $colname2_subcat4 = (get_magic_quotes_gpc()) ? $_POST['searchbox'] : addslashes($_POST['searchbox']);
$colname3_subcat4 = "-1";
if (isset($_POST['searchbox'])) {
  $colname3_subcat4 = (get_magic_quotes_gpc()) ? $_POST['searchbox'] : addslashes($_POST['searchbox']);
$colname4_subcat4 = "-1";
if (isset($_POST['searchbox'])) {
  $colname4_subcat4 = (get_magic_quotes_gpc()) ? $_POST['searchbox'] : addslashes($_POST['searchbox']);
$colname5_subcat4 = "-1";
if (isset($_POST['searchbox'])) {
  $colname5_subcat4 = (get_magic_quotes_gpc()) ? $_POST['searchbox'] : addslashes($_POST['searchbox']);
mysql_select_db($database_forms, $forms);
$query_subcat4 = sprintf("SELECT * FROM `forms` WHERE Title LIKE CONCAT('%%', %s, '%%') or Description LIKE CONCAT('%%', %s, '%%') or Category LIKE CONCAT('%%', %s, '%%') or SubCat1 LIKE CONCAT('%%', %s, '%%') or SubCat2 LIKE CONCAT('%%', %s, '%%') or SubCat3 LIKE CONCAT('%%', %s, '%%') or Keywords LIKE CONCAT('%%', %s, '%%') ORDER BY Description ASC", GetSQLValueString($colname_subcat4, "text"),GetSQLValueString($colname1_subcat4, "text"),GetSQLValueString($colname2_subcat4, "text"),GetSQLValueString($colname3_subcat4, "text"),GetSQLValueString($colname4_subcat4, "text"),GetSQLValueString($colname5_subcat4, "text"),GetSQLValueString($colname6_subcat4, "text"));
$subcat4 = mysql_query($query_subcat4, $forms) or die(mysql_error());
$row_subcat4 = mysql_fetch_assoc($subcat4);
$totalRows_subcat4 = mysql_num_rows($subcat4);
// date format function
function makeStamp($theString) {
  if (ereg("([0-9]{4})-([0-9]{2})-([0-9]{2}) ([0-9]{2}):([0-9]{2}):([0-9]{2})", $theString, $strReg)) {
    $theStamp = mktime($strReg[4],$strReg[5],$strReg[6],$strReg[2],$strReg[3],$strReg[1]);
  } else if (ereg("([0-9]{4})-([0-9]{2})-([0-9]{2})", $theString, $strReg)) {
    $theStamp = mktime(0,0,0,$strReg[2],$strReg[3],$strReg[1]);
  } else if (ereg("([0-9]{2}):([0-9]{2}):([0-9]{2})", $theString, $strReg)) {
    $theStamp = mktime($strReg[1],$strReg[2],$strReg[3],0,0,0);
  return $theStamp;
function makeDateTime($theString, $theFormat) {
  $theDate=date($theFormat, makeStamp($theString));
  return $theDate;
// end date format function
?><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<?php include('inc_titleia.php') ?>
<link href="styles.css" rel="stylesheet" type="text/css">
</head>
<body>
<div id="banneria"></div>
<div id="container">
    <div id="left">
<?php include('inc_formselectoria.php') ?>
    </div> <!-- end left -->
    <div id="right">
<?php if ($totalRows_subcat4 == 0) { // Show if recordset empty ?>
  <p class="largebold">Sorry.Not found.</p>
<?php } // Show if recordset empty ?>
<?php if ($totalRows_subcat4 > 0) { // Show if recordset not empty ?>
  <p class="largebold"></p>
      <?php do { ?>
<a href="../members/uploads/<?php echo $row_subcat4['File']; ?>">        <div id="subleft">Download <br>
  <br>
</div>
            <div id="subcenter"><?php echo $row_subcat4['Title']; ?><br>
              <?php echo $row_subcat4['Description']; ?></div>
            <div id="subright">Updated <?php echo makeDateTime($row_subcat4['Date'], 'm/d/Y'); ?></div>        </a>    <div id="clear">        </div>
        <hr><?php } while ($row_subcat4 = mysql_fetch_assoc($subcat4)); ?>
  <?php } // Show if recordset not empty ?>
      </div><!-- end right -->
  <div id="clear">        </div>
</div><!-- end container -->
</body>
</html>
<?php
mysql_free_result($subcat3);
mysql_free_result($category);
mysql_free_result($subcat1);
mysql_free_result($subcat2);
mysql_free_result($subcat4);
?>

Answer 1

>The search box being used allows the users to enter any phrase and the
>search script searches against all these tables for keywords, form numbers, names, etc
Does the form have a single search field?
>My problem is. Lets say I am logged in using the state IA...
Assuming that the 'form' table has a state field, you just need to include that in the WHERE clause. You can either get that when you log in, by retrieving it from the user table, or, by joining the two tables together in the query. The latter assumes that there is a relationship between user and form.
But again, I suggest as a first step to clean up the mess that you already have. The person that created this did not understand what they were doing.