PHP MySQL Select Where

The SELECT statement is used to fetch data from a database. The WHERE clause is used to filter data based on specific conditions. The WHERE clause can be combined with the SELECT statement to fetch only specific data from the database.

Here is the basic syntax of the SELECT statement with WHERE clause:

PHP / SQL basic syntax of the SELECT statement with WHERE clause

SELECT column1, column2, ...
FROM table_name
WHERE condition;

In the above syntax:

• column1, column2, ... are the columns you want to fetch data from.
• table_name is the name of the table you want to fetch data from.
• condition is a logical expression that determines what data to retrieve.

Example

Consider a table named customers with the following data:

Here is an example of how to use the SELECT statement with WHERE clause to retrieve only specific data from the customers table:

PHP / SQL example of how to use the SELECT statement with WHERE clause to retrieve only specific data from the customers table

SELECT name, email
FROM customers
WHERE country = 'USA';

The above SELECT statement will return only the rows where the country column is equal to USA. The output will be:

name      | email
----------|----------------------
John      | [email protected]

Multiple Conditions

You can also use multiple conditions in the WHERE clause. For example, you can retrieve all customers from the customers table who live in the USA and have an email address that ends with example.com.

PHP / SQL retrieve all customers from the customers table who live in the USA and have an email address that ends with example.com

SELECT name, email
FROM customers
WHERE country = 'USA'
AND email LIKE '%example.com';

The above SELECT statement will return the following output:

name      | email
----------|----------------------
John      | [email protected]

You can use logical operators such as AND and OR to combine multiple conditions in the WHERE clause. When you mix them, wrap the OR group in parentheses so the precedence is what you expect:

SELECT name, email
FROM customers
WHERE country = 'USA'
AND (name = 'John' OR name = 'Alice');

Comparison and Logical Operators

The condition in a WHERE clause is built from operators. These are the ones you will use most often:

A few common patterns:

-- Match several values without writing OR three times
SELECT name FROM customers WHERE country IN ('USA', 'UK', 'France');

-- Inclusive numeric range
SELECT name FROM customers WHERE id BETWEEN 1 AND 2;

-- Find rows where a value is missing (do NOT use = NULL — that never matches)
SELECT name FROM customers WHERE email IS NULL;

Running a WHERE Query from PHP

The page title is "PHP MySQL", so here is the part that actually runs in PHP. Because the WHERE value almost always comes from user input (a search box, a URL parameter), you must never concatenate it directly into the SQL string — that opens the door to SQL injection. Use a prepared statement and bind the value as a parameter instead.

Example: filtering by country with a PDO prepared statement

<?php
$pdo = new PDO('mysql:host=localhost;dbname=shop;charset=utf8mb4', 'user', 'password');
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

// The user-supplied value never touches the SQL text directly.
$country = $_GET['country'] ?? 'USA';

$stmt = $pdo->prepare('SELECT name, email FROM customers WHERE country = ?');
$stmt->execute([$country]);

foreach ($stmt->fetchAll(PDO::FETCH_ASSOC) as $row) {
    echo $row['name'] . ' - ' . $row['email'] . "\n";
}

The same query with MySQLi looks like this:

Example: the same query with MySQLi

<?php
$conn = new mysqli('localhost', 'user', 'password', 'shop');

$country = $_GET['country'] ?? 'USA';

$stmt = $conn->prepare('SELECT name, email FROM customers WHERE country = ?');
$stmt->bind_param('s', $country); // 's' = the parameter is a string
$stmt->execute();
$result = $stmt->get_result();

while ($row = $result->fetch_assoc()) {
    echo $row['name'] . ' - ' . $row['email'] . "\n";
}

Security Note: Always filter user-supplied input through bound parameters (PDO or MySQLi), never by building the SQL string with "... WHERE country = '$country'". Prepared statements keep data and code separate, which is what prevents SQL injection.

Related Topics

• PHP MySQL Select — the SELECT basics this clause builds on.
• PHP MySQL Order By — sort the rows your WHERE clause returns.
• PHP MySQL Limit Data — cap how many filtered rows come back.
• PHP MySQL Prepared Statements — a deeper look at the safe pattern used above.

Practice