Please, oh please, do not put your variables right into your SQL statement. That's just asking for long-term problems. Nevermind nasty injection bugs.

my @where;
my @binds;
if ($emp_user_name ne "*")
{
    if ($bb_activity_code) {
        push @where, 'bb_activity_code LIKE ?';
        push @binds, "%$bb_activity_code%";
    }
    if ($bb_model) {
        push @where, 'bb_model = ?';
        push @binds, $bb_model
    }
    if ($bb_pin) {
        push @where, 'bb_pin LIKE ?';
        push @binds, "%$bb_pin%";
    }
    if ($bb_phone) {
        push @where, 'bb_phone LIKE ?';
        push @binds, "%$bb_phone%";
    }
    if ($bb_imei_esn_dec) {
        push @where, 'bb_imei_esn_dec LIKE ?';
        push @binds, "%$bb_imei_esn_dec%";
    }
    if ($bb_status) {
        push @where, 'bb_status = ?';
        push @binds, $bb_status
    }
    if ($bb_region_code) {
        push @where, 'bb_region_code = ?';
        push @binds, $bb_region_code
    }
    if (@where) {
        push @where 'emp_user_name LIKE ?';
        push @binds, "%$emp_user_name%";
    }
}
my $statement = "SELECT bb_id, emp_user_name, bb_activity_code, bb_mod
+el, bb_pin, bb_phone, bb_imei_esn_dec, bb_status, bb_region_code FROM
+ blackberry";
$statement .= ' WHERE ' . join(' AND ', @where) if @where;
$statement .= ' ORDER BY emp_user_name';
[download]

Of course, you then have to bind @binds to your query, which I assume is possible with Win32::ODBC, but I'll leave that to you to look at. Anyway, this should be much simpler than what you had - and easier to add to or otherwise modify. In fact, I'd go another step and put all those variables into a hash, and then you could loop through them to generate the SQL statement. A bit more abstraction which could make runtime a bit slower, but make modifications (of the code) much faster.

I notice you print out the sql statement at the end of your HTML. At risk of stating the obvious, have you run the failing sql statements directly against the database, to see if you get the same results?

Thanks for your reply!

I print out the statement in white for debugging purposes.

I ran this query against the DB and it came back fine, but in the script it hangs:

SELECT bb_id, emp_user_name, bb_activity_code, bb_model, bb_pin, bb_ph
+one, bb_imei_esn_dec, bb_status, bb_region_code FROM blackberry ORDER
+ BY emp_user_name
[download]

This script returned no values in Access, but once i removed the emp_user_name LIKE '%%' part, it ran fine:

SELECT bb_id, emp_user_name, bb_activity_code, bb_model, bb_pin, bb_ph
+one, bb_imei_esn_dec, bb_status, bb_region_code FROM blackberry WHERE
+ emp_user_name LIKE '%%' AND bb_status='DEPLOYED' ORDER BY emp_user_n
+ame
[download]

I'm going to make a few modifications to see if i can fix it now that i have more to work with.

Thanks for the advice!

I actually expect that this line is a mistake, or at least the assignment to @_ is unnecessary:

my ($sql_bb_activity_code,...,$sql_bb_region_code)=@_;
[download]

use strict;   #  I assume your app already has this somewhere

#####################
# DECLARE VARIABLES #
#####################

my $count = 0;          # Count the number of rows
my @grab_results = ();  # Array containing results
my $statement;          # sql statement
my @error = ();         # Array to store any DB errors
my $connection_status;  # Tells us whether we connected to a DB or not

##################
# CGI PARAMETERS #
##################

my %bb;
my @fldnames = qw(emp_user_name bb_activity_code bb_model  bb_pin
                  bb_phone      bb_imei_esn_doc  bb_status bb_region_c
+ode);
my @fldops  =  qw(LIKE          LIKE             =         LIKE
                  LIKE          LIKE             =         =);

$bb{$_} = clean_sql(param($_)) for ( @fldnames );

##########################
# Generate SQL statement #
##########################

my $whereclause = '';
if ( $bb{emp_user_name} ne '*')
{
    my @conditions = ();
    for my $i ( 0 .. $#fldnames )
    {
        my $fname = $fldnames[$i];

        if ( $bb{$fname} ne '' )
        {
            push @conditions, "$fname $fldops[$i] " .
                (( $fldops[$i] eq '=' ) ?  $bb{$fname} : "\%$bb{$fname
+}\%" );
        }
    }
    exit if ( @conditions == 0 );

    $whereclause = 'WHERE ' . join( ' AND ', @conditions );
}

$statement = 'SELECT ' . join( ',', 'bb_id', @fldnames ) .
        " FROM blackberry $whereclause ORDER BY emp_user_name";


##################################################
# Connect to the database and send sql statement #
##################################################
# ...
[download]

As for your later observations about how the script hangs with the sql statement that has no "WHERE" clause, you might need to make up an ad-hoc perl script that you can run from the command line to connect to the database and just run that one query and print output to the screen, to see what happens.

Thanks for your reply!
The @_ is unnecessary, and clean_sql() replaces SQL and ODBC characters with ASCI code, i.e, $sql=~s/\'/\' \& chr\(39\) \& \'/g;

Ok, so i'm using your code and i am getting the same results. when i search for status='DEPLOYED' or emp_user_name='*', it hangs and times out. I'll keep playing around with it tonight, i'll let you guys know what i find. BTW, running the SQL statement agains Access works just fine. I might have to switch to MYSQL : ). Thanks for all the replies... -Kiko