$string=$_GET['string'];
$cat=$_GET['cat'];
$order=$_GET['order'];
$dir=$_GET['dir'];
$sql="SELECT * FROM `test` WHERE `name` LIKE '$string' OR `brand` LIKE '$string' OR `category` LIKE '$string' ORDER BY $order $dir";

$order=$_GET['order'];
$dir=$_GET['dir'];

$order=id;
$dir=DESC;

//default values for $order and $dir
$dir     = "asc";

$order = "name";

$string = "";  //empty default (show all within reason)

$cat     = ""; //no cat set yet

//basic sql to pull [all] records
$sql     = "SELECT * FROM test WHERE 1 ";

//get the values (note you should validate this data or someone will hack
//your site)
//(string) justed forces the data to be a string (this is not validation)
//the '%' indicates a wildcard search, so the below statements would match
//anything where the $string value is in the word, beginning, middle or end

if(!empty($_GET['string'])){
  $string=(string)$_GET['string'];   //search string
 
  $sql .= " AND name LIKE '%$string%' OR brand LIKE '%$string%' ";
}//end if

if(!empty($_GET['cat'])){
  $cat    =(string)$_GET['cat'];      //category
 
  $sql .= " OR category like '%$string%' ";


//check $dir first since it just needs to be a var to fit into the sql
if(!empty($_GET['dir'])){
  $dir     =(string)$_GET['dir'];          //dir of order by
}

if(!empty($_GET['order'])){
  $order =(string)$_GET['order'];   //order by

  $sql .= "ORDER BY $order $dir";
}