Thanks for the reply, Tony.

The grid is being presented as read-only, so no injection worries, but the user form that feeds it uses something like:

$query = sprintf (“
INSERT INTO my_table (id,a,b)
VALUES
('%d','%s','%s')”,
$id,
mysql_real_escape_string($_POST['a'], $conn),
mysql_real_escape_string($_POST['b'], $conn)
);

Otherwise, this seems to work fine:

if ($_GET['_search'] == “true”) {

$where_clause_1 = “”;

$ss = $_GET['searchString'];

$eq = “= '”.$ss.”'”;
$ne = ” '”.$ss.”'”;
$lt = “< '".$ss."'";
$le = “<= '".$ss."'";
$gt = “> '”.$ss.”'”;
$ge = “>= '”.$ss.”'”;
$bw = “LIKE '”.$ss.”%'”;
$ew = “LIKE '%”.$ss.”'”;
$cn = “LIKE '%”.$ss.”%'”;
$ge = “>= “.$ss;

$search_ar = array(
'eq' => $eq, 'ne' => $ne, 'lt' => $lt, 'le' => $le, 'gt' => $gt,
'ge' => $ge, 'bw' => $bw, 'ew' => $ew, 'cn' => $cn
);

$where_clause_2 = “
WHERE ”.$_GET['searchField'].” “.$search_ar[$_GET['searchOper']].”
“;

} else {
$where_clause_1 = “”;
$where_clause_2 = “”;
}

-Gary (aka Tq46)