<?php
$searchstring=$_POST['searchstring']; 
if ($searchstring) 
{ 
$db=mysql_connect("localhost","username","password"); 
mysql_select_db("DBname",$db) ; 

$sql="SELECT DISTINCT countries.countries_name, countries.countries_id, users.* FROM users, countries WHERE country_id = '" . $row["countries_id"] . "' AND empl_status like '%$searchstring%' order by fname ASC"; 

$result=mysql_query($sql,$db) ; 
$num = mysql_num_rows($result); 

echo "<p>Your search criteria has <strong> $num </strong> result(s).<br/></p>"; 
while ($row=mysql_fetch_array($result)) 
{ 

echo "<li>" . $row["fname"]. "</li><br />\n"; 

} 

echo "<form method='POST' action='search.php'> 

<input type='submit' value='Search Again' name='B1'> 
</form>"; 
} 
else 
{ 
?> 

<form method="POST" action="<?php $PHP_SELF ?>"> 
<table broder="2" cellspacing="2"> 
<tr><td>Insert your search string here</td> 
</tr> 
<tr> 
<td><input type="text" name="searchstring" size="28"></td> 
</tr> 
</table> 
<p><input type="submit" value="Search" name="B1"><input type="reset" value="Reset"></p> 
</form> 

<? 
} 

?>

<?php

// get the search string from the form
$searchstring = mysql_escape_string( $_POST['searchstring'] );
if ($searchstring)
{
  $db=mysql_connect("localhost","username","password");
  mysql_select_db("DBname",$db) ;

  // build the bits off the sql string to search for the country id if set
  $sql_country  = null;
  if( $_POST['countries_id'] )
  {
    $_POST['countries_id'] = intval( $_POST['countries_id'] );
    $sql_country = "country_id = $_POST[countries_id] AND ";
  }

  $sql="SELECT DISTINCT countries.countries_name, countries.countries_id, users.* FROM users, countries WHERE {$sql_country}empl_status like '%$searchstring%' order by fname ASC";
?>