Building an SQL query string
Use Prepared Statements

Your code is vulnerable to SQL injection attacks.  Use PDO or mysqli prepared statements to avoid this. See this answer for how to use PDO for this.  If you are using mysql_* you should know that it is already in the deprecation process.

Miscellaneous


Consider using empty to check for empty strings (see comment from Corbin below).
Personally I would use an if else rather than have two identical ternary conditions.