PHP SQL串联

Question

I have a SQL query in which I want to select records that where paid between two dates.

Here's how I build my query:

$qry = array();
    $qry[] = "SELECT DISTINCT 2 AS Record_Type, wp_woocommerce_order_items.order_id As Order_Id, First_Name;
    $qry[] = "FROM  wp_woocommerce_order_items";
    $qry[] = "LEFT JOIN (SELECT meta_value As First_Name, post_id FROM wp_postmeta WHERE meta_key = '_shipping_first_name') AS a";
    $qry[] = "ON wp_woocommerce_order_items.order_id = a.post_id";
    $qry[] = "RIGHT JOIN (SELECT post_id FROM wp_postmeta WHERE meta_key = '_paid_date' AND meta_value > " .$_POST['debut'] . " AND meta_value < " . $_POST['fin'] . ") AS m";
    $qry[] = "ON wp_woocommerce_order_items.order_id = m.post_id";
    $qry[] = "WHERE wp_woocommerce_order_items.order_item_type = 'line_item'";
    $qry[] = "ORDER BY wp_woocommerce_order_items.order_id";

The problem is with my POST variables in the RIGHT JOIN line. If I hardcode a date instead of $_POST['debut'] and $_POST['fin'] I get the result I'm looking for.

So I guess my problem is with concatenation from my PHP POST variables.

Anyone can help me?

Answer 1

You need to quote your values, eg instead of

$qry[] = "RIGHT JOIN (SELECT post_id FROM wp_postmeta WHERE meta_key = '_paid_date' AND meta_value > " .$_POST['debut'] . " AND meta_value < " . $_POST['fin'] . ") AS m";

use

$qry[] = "RIGHT JOIN (SELECT post_id FROM wp_postmeta WHERE meta_key = '_paid_date' AND meta_value > '" .$_POST['debut'] . "' AND meta_value < '" . $_POST['fin'] . "') AS m";

And please look for mysql_real_escape_string or other ways to avoid SQL injection attacks.

Answer 2

Use this

$qry[] = "SELECT DISTINCT 2 AS Record_Type, wp_woocommerce_order_items.order_id As Order_Id, First_Name
    FROM  wp_woocommerce_order_items
    LEFT JOIN (SELECT meta_value As First_Name, post_id FROM wp_postmeta WHERE meta_key = '_shipping_first_name') AS a
    ON wp_woocommerce_order_items.order_id = a.post_id
    RIGHT JOIN (SELECT post_id FROM wp_postmeta WHERE meta_key = '_paid_date' AND meta_value > '" .$_POST['debut'] . "' AND meta_value < '" . $_POST['fin'] . "'') AS m
    ON wp_woocommerce_order_items.order_id = m.post_id
    WHERE wp_woocommerce_order_items.order_item_type = 'line_item'
    ORDER BY wp_woocommerce_order_items.order_id";