Query Parameters and Filtering

# CHAPTER 11

Query Parameters and Filtering #

1. Introduction #

2. Learning Objectives #

• Identify query parameters in a URL string.

• Differentiate between path parameters (URLs) and query parameters.

• Use query parameters to filter data in a REST API.

• Implement basic dynamic SQL queries based on query strings.

• Understand the security implications of user-provided query data.

3. Beginner-Friendly Explanation #

In a URL, this translates to: /shoes?size=10&color=red&brand=nike

The ? marks the beginning of the query string. The & separates different filters. These are Query Parameters. They don't change *what* resource you are looking for (shoes), they just narrow down the results.

4. Real-World Examples #

• E-Commerce: Searching for a laptop under $1000: /products?category=laptops&maxprice=1000

• Analytics: Fetching data between two dates: /sales?startdate=2023-01-01&enddate=2023-12-31

<?php
// API Endpoint: /users

// 1. Get the query parameters, set defaults if not provided
$status = $_GET[&#039;status'] ?? 'all';
$role = $_GET[&#039;role'] ?? 'all';

// 2. Base SQL Query
$sql = "SELECT id, name, status, role FROM users WHERE 1=1";
$params = [];

// 3. Dynamically build the query based on filters
if ($status !== &#039;all') {
    $sql .= " AND status = :status";
    $params[&#039;:status'] = $status;
}

if ($role !== &#039;all') {
    $sql .= " AND role = :role";
    $params[&#039;:role'] = $role;
}

// 4. Execute (using PDO to prevent SQL injection)
$stmt = $pdo->prepare($sql);
$stmt->execute($params);
$users = $stmt->fetchAll(PDO::FETCH_ASSOC);

echo json_encode($users);
?>

6. Request/Response Examples #

Request:

GET /articles?author_id=5&published=true HTTP/1.1
Host: api.blog.com

Response:

[
  {
    "id": 101,
    "title": "REST API Basics",
    "author_id": 5,
    "published": true
  }
]

7. HTTP Examples #

• Path Parameter: Used to identify a *specific* resource.

• Correct: /users/5

• Incorrect: /users?id=5

• Query Parameter: Used to sort, filter, or limit a *collection* of resources.

• Correct: /users?role=admin

• Incorrect: /users/role/admin

8. JSON Examples #

{
  "meta": {
    "total_results": 15,
    "filters_applied": {
      "role": "admin",
      "status": "active"
    }
  },
  "data": [
    {"id": 4, "name": "Admin User 1"},
    {"id": 8, "name": "Admin User 2"}
  ]
}

9. Best Practices #

• Use standard naming: Keep parameter names simple and lowercase (e.g., ?minprice=10, not ?MinimumPriceValue=10).

• Always use Prepared Statements: Never insert $GET variables directly into your SQL string. Always use parameterized queries (PDO) to prevent SQL Injection.

10. Common Mistakes #

• Ignoring Validation: Just because a user passes ?age=twenty, doesn't mean your database will accept a string. Always validate and sanitize query parameters before processing them in PHP.

• Overcomplicating filters: Creating massive, complex JSON filter objects and trying to pass them via GET requests (which have URL length limits). If filtering becomes extremely complex, some APIs switch to using a POST /search endpoint with a JSON body.

11. Mini Exercises #

1. 1. Look at this URL: https://api.weather.com/forecast?city=london&days=3. What are the keys and values of the query parameters?

12. Coding Challenges #

• Q: What happens if a client passes a query parameter that your API does not recognize (e.g., ?fakeparam=true)? How should the API handle it?

15. FAQs #

Q: Is there a limit to how many query parameters I can add? A: Technically no, but browsers and web servers have maximum URL length limits (usually around 2000 characters). If your query string is getting that long, you should rethink your design.

16. Summary #

17. Next Chapter Recommendation #