The code is not working correctly, can you help?

Question

PHP

The essence of its work: there is such a code that filters the result, they say there is a result with the "Teg1" tag, then by the link "index.php? ?filter=Tag1-Tag2-Tag3-Tag4 etc." then the result with these tags is displayed.
But for some reason it doesn't work, can anyone fix it? I will be grateful!
I write "index.php?filter=Teg1-Teg2" For some reason, `banner` with `country` and c "category_id" is not filtered, but separately everything works ...
I'm just learning, so if it's not difficult to correct the code, and tell me what you did wrong.

$filter = NULL; 
if(isset($_GET['filter'])){ 
$_GET['filter'] = sanitize($_GET['filter']); 

if(preg_match('#[0-9]#',$_GET['filter'])) $filter = "AND `banner` = '" . $_GET['filter'] . "'"; 
elseif(strlen($_GET['filter']) == 2) $filter = "AND `country` = '" . $_GET['filter'] . "'"; 
else { 
$arr = array_map(function($v){return str_replace("'", "", $v);}, explode('-', $_GET['filter']));
$names = implode("' , '", $arr);
$filter = "AND `category_id` in (SELECT `category_id` FROM `categories` WHERE `name` IN ('$names'))";
} 
}

Example:
index.php?filter=1.5.2 is a banner
index.php?filter=RU is a country
index.php?filter=Tag1-Tag2 is a list of tags
How should it work:
index.php?filter=1.5 .2-RU
index.php?filter=Tag1-RU-1.5.2

Answer 1

You need to use different variables or collect very complex values, then parse / parse them in parts.
Right now you can only do one thing here.

Answer 2

$_GET['filter'] = '1.5.2'; # AND `banner` = '1.5.2'
$_GET['filter'] = 'RU'; # AND `country` = 'RU'
$_GET['filter'] = 'Тег-Тег'; #AND `category_id` in (SELECT `category_id` FROM `categories` WHERE `name` IN ('Тег' , 'Тег'))
$_GET['filter'] = '1.5.2_RU_Тег-Тег'; # AND `banner` = '1.5.2' AND `country` = 'RU' AND `category_id` in (SELECT `category_id` FROM `categories` WHERE `name` IN ('Тег' , 'Тег'))
$_GET['filter'] = '1.5.2_RU'; # AND `banner` = '1.5.2' AND `country` = 'RU'

$sql = [];
if(isset($_GET['filter'])) {
    $filter = sanitize($_GET['filter']); 
    $filter = explode('_', $filter);

    for ($i = 0; $i < count($filter); $i++) {
        if (preg_match('#^[0-9|\.]+$#', $filter[$i]))
            $sql[] = "AND `banner` = '{$filter[$i]}'"; 
        elseif (preg_match('#^[A-Z]{2}$#', $filter[$i]))
            $sql[] = "AND `country` = '{$filter[$i]}'"; 
        else {
            $tags = array_map(function($v) {
                return str_replace("'", "", $v);
            }, explode('-', $filter[$i]));
            $names = implode("' , '", $tags);
            $sql[] = "AND `category_id` in (SELECT `category_id` FROM `categories` WHERE `name` IN ('{$names}'))";
        }
    }
}
$sql = implode(' ', $sql);
echo $sql; // это пихать в запрос к БД

Above are defined , these are examples of queries and their result $_GET['filter']

Answer 3

It's good to use the filter_input() function to filter input .
To work with the database, use PDO .

$param = filter_input(INPUT_GET, 'filter', FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH);
$filters = explode('-', $param);

$banner = $country = NULL;
$tags = [];

if( count($filters)) {
  foreach($filters AS $filter) {
    if( preg_match('/^[0-9\.]+$/', $filter)) { // 1.5.9
      $banner = $filter;
    } elseif( preg_match('/^(RU|EN)$/', $filter) { //  RU
      $country = $filter;
    } else { // tag
      array_push($tags, $filter);
    }
  }
}

$conditions = [];
$params = [];
if($banner) {
  array_push($conditions, "`banner` = ?");
  array_push($params, $banner);
}

if($country) {
  array_push($conditions, "`country` = ?");
  array_push($params, $country);
}

if(count($tags)) {
  foreach($tags AS $tag) array_push($params, $tag);
  
  array_push($conditions, sprintf(
    "`category_id` IN (SELECT `category_id` FROM `categories` WHERE `name` IN (%s)",
    implode(',', str_split( str_repeat('?', count($tags))))
  ));
}

$query = 'SELECT * FROM sometable';
if( count($conditions)) $query = $query . ' WHERE ' . implode(' AND ', $conditions);

$stmt = $dbh->prepare($query);
if( $stmt->execute($params)) {
  while ($row = $stmt->fetch()) {
    print_r($row);
  }
}