<?php

/* PDO database connection here */
//$pdo = ...

$query = 'SELECT * FROM table';
$params = array();
$paramsCount = 0;

if (isset($_GET['location']))
{
    /*  Important: you must also check whether $_GET['location'] is valid before using it.
        For example, check its length, its chars, etc. */

    if ($paramsCount == 0)
    {
        $query .= ' WHERE';
    }
    else
    {
        $query .= ' AND';
    }

    $paramsCount++;
    $query .= 'location = :location';
    $params[':location'] = $_GET['location'];
}

if (isset($_GET['category']))
{
    /*  Important: you must also check whether $_GET['category'] is valid before using it.
        For example, check its length, its chars, etc. */

    if ($paramsCount == 0)
    {
        $query .= ' WHERE';
    }
    else
    {
        $query .= ' AND';
    }

    $paramsCount++;
    $query .= 'category = :category';
    $params[':category'] = $_GET['category'];
}

if (isset($_GET['subcategory']))
{
    /*  Important: you must also check whether $_GET['subcategory'] is valid before using it.
        For example, check its length, its chars, etc. */

    if ($paramsCount == 0)
    {
        $query .= ' WHERE';
    }
    else
    {
        $query .= ' AND';
    }

    $paramsCount++;
    $query .= 'subcategory = :subcategory';
    $params[':subcategory'] = $_GET['subcategory'];
}

/* Now execute the query. */
try
{
    $res = $pdo->prepare($query);
    $res->execute($params);
}
catch (PDOException $e)
{
    echo 'Query error: ' . $e->getMessage();
}