real_escape_string($_GET['customer_id']); //Assumes a numeric ID, wrap in quotes for an alpha-numeric ID }elseif(!empty($_GET['email'])){ //If no ID then try email $filter = 'email='.$link->real_escape_string($_GET['email']); }elseif(!empty($_GET['last_name'])){ //If no ID or email then search on last name $filter = 'lastname="'.$link->real_escape_string($_GET['last_name']).'"'; }elseif(!empty($_GET['first_name'])){ //Try first name if no ID,email,last name $filter = 'firstname="'.$link->real_escape_string($_GET['first_name']).'"'; }else{ $filter = '1=0'; //Don't return any results } /***** QUERY DATABASE *****/ //Select the database to query mysqli_select_db($link, $name); //Query the db $result = $link->query('SELECT * FROM customers WHERE '.$filter); /***** OUTPUT LIVE LOOKUP XML *****/ header('Content-type: text/xml'); echo ''; ?>