So I am making post requests to a page for search queries. I am turning them into a session array so I can paginate the results. The process kind of feels ugly and long winded. I need code review for two things.Shortening / making this code more elegant if possibleSecurity - any glaringly obvious vulnerabilities I have missed. I am running the posts through mysqli_real_escape_string but is the way I am building the query vulnerable?input appreciated<?phpif ($_SERVER['REQUEST_METHOD'] == POST) {    //only accept posts from our domain    if (strpos($_SERVER['HTTP_REFERER'], DOMAIN)) {        if (isset($_POST['csrf_token']) && $_POST['csrf_token'] === $_SESSION['csrf_token']) {            // some arrays to check against            $stock_type         = array(                beers,                wines,                spirits,                apops            );            $trade_type         = array(                buying,                selling            );            // create session array from post variables            $_SESSION['search'] = array(                'stock_type' => mysqli_real_escape_string($connection, $_POST['stock_type']),                'trade_type' => mysqli_real_escape_string($connection, $_POST['trade_type']),                'brand' => mysqli_real_escape_string($connection, $_POST['brand']),                'country' => mysqli_real_escape_string($connection, $_POST['country']),                'min' => mysqli_real_escape_string($connection, $_POST['min']),                'max' => mysqli_real_escape_string($connection, $_POST['max']),                'user' => mysqli_real_escape_string($connection, $_POST['user'])            );            // the start of the search variable            $where              = WHERE t.published = 1;            // buld up the search variable based on whats been posted            if (!empty($_SESSION['search']['stock_type']) && in_array($_SESSION['search']['stock_type'], $stock_type)) {                $where .=  and t.stock_type = ' . $_SESSION['search']['stock_type'] . ';            }            if (!empty($_SESSION['search']['trade_type']) && in_array($_SESSION['search']['trade_type'], $trade_type)) {                $where .=  and t.buying_selling= ' . $_SESSION['search']['trade_type'] . ';            }            if (!empty($_SESSION['search']['brand'])) {                $where .=  and t.brand LIKE '% .$_SESSION['search']['brand']. %';            }            if (!empty($_SESSION['search']['country']) && in_array($_SESSION['search']['country'], $country_list)) {                $where .=  and u.country= ' . $_SESSION['search']['country'] . ';            }            if (!empty($_SESSION['search']['min']) && ctype_digit($_SESSION['search']['min'])) {                $where .=  and t.price >= ' . $_SESSION['search']['min'] . ';            }            if (!empty($_SESSION['search']['max']) && ctype_digit($_SESSION['search']['max'])) {                $where .=  and t.price <= ' . $_SESSION['search']['max'] . ';            }            if (!empty($_SESSION['search']['user']) && ctype_digit($_SESSION['search']['user'])) {                $where .=  and u.subscription = ' . $_SESSION['search']['user'] . ';            }            $_SESSION['where'] = $where;        }    }} else {    $where = $_SESSION['where'];}if (isset($_SESSION['where'])) {    mysqli_select_db($connection, $database_connection);    $query = SELECT SQL_CALC_FOUND_ROWS t.*,                    u.subType,                    Count(l.trade_id) AS leads                     FROM   trading t                            LEFT JOIN leads l                                   ON l.trade_id = t.trade_id                          LEFT JOIN users u                                   ON u.user_id = t.user_id                     $where                    GROUP  BY t.trade_id                     ORDER  BY timestamp DESC                     LIMIT  $start, $perpage;    $something = mysqli_query($connection, $query) or die(mysqli_error($connection));    $totalRows = mysqli_num_rows($something);}?>
Building session array from post to build search query
php;mysqli