Subqueries are probably your answer. This all seems kind of redundant as all towns is the first option and is the default selected option and yet the checkbox for county is there too. Or does that mean all towns no matter which county, meaning it may ignore county altogether? So that would mean you need to do some pre-filtering logic before we even get to this other query, right?

All right, no matter I must say the first thing to do is escape that user-supplied data -- meaning do not ever trust raw $_POST data. PHP has the MySQL API mysql_real_escape_string [php.net] to help you there.

$town = mysql_real_escape_string($_POST['Town']);

Next, the query you have will select just that town. Add the town column to your options list and add the county logic to your WHERE clause, if the checkbox is present. You could use DISTINCT or "LIMIT 1", either would suffice. Your result set can be ordered by town first if you would like. Then as you loop through you can separate by town (ORDER BY if necessary).

// rough idea, but should get you started 
// (untested code, by the way ;) 
// ... and this assumes a town was checked, not all towns 
$town = mysql_real_escape_string($_POST['Town']); 
if (isset($_POST['cty'])) { 
  $where =  
    "producers.countyFieldName = 
      (SELECT DISTINCT 
        producers.countyFieldName 
      FROM producers 
      WHERE 
        producers.ShowProd = TRUE AND 
        producers.Town = '{$town}') 
    " 
  ; 
} else { 
  $where = "WHERE producers.ShowProd = TRUE AND producers.Town = '{$town}'"; 
} 
$sql= 
"SELECT 
  producers.pid, 
  producers.FarmName, 
  producers.LName1, 
  producers.FName1, 
  producers.Town 
FROM producers 
{$where} 
ORDER BY 
  FarmName, 
  LName1" 
;

Like I said, this may contain errors but hopefully you can see where it is headed. Give it a shot and if you have troubles, come back ;)

Ah! Subqueries - that's the term I was looking for.

All towns searches for all of the towns in the db that fit the criteria (2 other filters). The checkbox is only for towns within the same county.

>> escape that user-supplied data

You're right of course. Should I still apply the escape even if that data is from a drop down list? Or are you thinking the form is still open to exploit?

Thanks coop - I'll take what you posted and work with it.

Should I still apply the escape even if that data is from a drop down list?

Yes. One can easily manipulate a drop down list value and post the form to your server.

Via $_POST['var_name'] right?

Is there a way to loop through the $_POST variables and "wash" them using mysql_real_escape_string(), then stick them back into the $_POST array?

You could do that, but you are best served analyzing form data for what you expect to see, discard everything else.

And yes to the $_POST question/confirmation. And it goes beyond that. A user can "File > Save" your html their desktop, modify the html and then post it to your server. Users can append data to the query string which modifies your $_GET superglobal array. Even $_SERVER vars can contain user-supplied data. $_SERVER['REQUEST_URI'] comes from the address bar in the browser.

Like I said, you are best served analyzing all input data, one by one.