这个MySQL查询有效吗？

Question

So I came across this when I visited a friend. He is trying to show in a table data from his created DB.

This is the part where he asks for the Start and End dates:

<form method="post">
    <input type="date" name="Date1" value="<?php echo $_POST['StartD'] ?>" style="position:absolute; top:2em; left:7em;">
    <p style="font-family:Calibri; color:green; font-size:15px; position: absolute; top: 1em; left: 18em;">to</p>
    <input type="date" name="Date2" value="<?php echo $_POST['EndD'] ?>" style="position:absolute; top:2em; left:23em;"><br />
    <input type="submit" id="Sbtn" style="cursor: pointer;" name="search_projects" value="Search">
</form>

This is now his MySQL query:

$sql= "SELECT * FROM statisticData WHERE accessDate LIKE '%" . $_POST['StartD'] . "%' OR accessDate LIKE '%" . $_POST['EndD'] . "%' ORDER BY accessDate ASC";

Whenever he chooses the Star date: 09-13-13 and an End date: 09-13-13 , the dates such as 09-12-13 also appears in the table. I told him to go and ask the professionals and he says he's too shy. So I'm asking instead.

Here's his code:

<div class="scrollableTable">
<center><table class="font1" border="3px solid white" width="70%">
    <thead> 
    <tr id="tblRow">
        <th id="tblData" width="20%">Access Date</td>
        <th id="tblData" width="15%">ID number</td>
            <th id="tblData" width="35%">Name</td>
        <th id="tblData" width="20%">Keyword</td>
    </tr>
    </thead>
   <?php
  if ($_POST['search_projects']){

  $con= mysql_connect("...","...","...") or die ('Error: ' . mysql_error()); 
   mysql_select_db("...");
   $sql= "SELECT * FROM statisticData WHERE accessDate LIKE '%" . $_POST['StartD'] . "%' AND  accessDate LIKE '%" . $_POST['EndD'] . "%' ORDER BY accessDate DESC";
   $result= mysql_query($sql); 

    while($row= mysql_fetch_object($result))
    { 
    $Date=$row->accessDate; 
    $ID=$row->IDnum;
    $Name=$row->Sname; 
            $Key=$row->keyWord;

    echo "<tr>"; 
    echo "<td>" . $Date.  " </td>" . " <td>" . $ID.  " </td>" . " <td>" . $Name.  " </td>". " <td>" . $Key.  " </td>"; 
    echo "</tr>"; 

    }
    echo "</table>";
    echo "</center>";
    }
 ?>
 </div>

He wants to allow the user to browse the contents of the database using these date inputs.

The problem is even when I choose the start and end dates, all the contents are shown in the table. His query does not filter the results at all. I told him to sleep it off, but he just keeps bugging me. So what do you think should he do to finally get some sleep?

Answer 1

People problem is in names:

$sql= "SELECT * FROM statisticData WHERE accessDate LIKE '%" . $_POST['Date1'] . "%' OR accessDate LIKE '%" . $_POST['Date2'] . "%' ORDER BY accessDate ASC";

also:

<form method="post">
<input type="date" name="Date1" value="<?php echo $_POST['Date1'] ?>" style="position:absolute; top:2em; left:7em;">
<p style="font-family:Calibri; color:green; font-size:15px; position: absolute; top: 1em; left: 18em;">to</p>
<input type="date" name="Date2" value="<?php echo $_POST['Date2'] ?>" style="position:absolute; top:2em; left:23em;"><br />
<input type="submit" id="Sbtn" style="cursor: pointer;" name="search_projects" value="Search">
</form>

Update:

• We have to convert time for MySQL
• And use BETWEEN statement

<?php
    if ($_POST['search_projects']){

    $startDate = date("Y-m-d", strtotime($_POST['Date1']));
    $endDate   = date("Y-m-d", strtotime($_POST['Date2']));

    $con= mysql_connect("...","...","...") or die ('Error: ' . mysql_error()); 
    mysql_select_db("...");
    $sql= "SELECT * FROM statisticData WHERE accessDate BETWEEN '$startDate' AND '$endDate' ORDER BY accessDate DESC";
    $result= mysql_query($sql); 
    ...

Answer 2

Use BETWEEN .

$sql= "
    SELECT * 
    FROM statisticData 
    WHERE accessDate BETWEEN '{$_POST['StartD']}' AND '{$_POST['EndD']}
    ORDER BY accessDate ASC
";

And please read How can I prevent SQL injection in PHP?

Answer 3

it looks good Try to use this one

$sql= "SELECT * FROM statisticData WHERE accessDate LIKE '" . $_POST['StartD'] . "' OR accessDate LIKE '" . $_POST['EndD'] . "' ORDER BY accessDate ASC";

OR use

$sql= "SELECT * FROM statisticData WHERE accessDate BETWEEN '" . $_POST['StartD'] . "' AND '" . $_POST['EndD'] . "' ORDER BY accessDate ASC";

Answer 4

used this

$sql= "SELECT *
FROM `statisticData`
WHERE (accessDate BETWEEN '".$_POST['StartD']."' AND '" . $_POST['EndD'] . "') ORDER BY accessDate ASC";

Answer 5

In my opinion it is a bad practice for three reasons:

1) You have an SQL-injection vulnerability here - you must escape your input

2) If you use datetime format in your DB, but want to select by date without time - you should convert type with functions like DATE()

3) Using LIKE statement is much more slower than exact comparison, which is for your needs is BETWEEN statement. And LIKE is mostly for just string-like data types

Answer 6

is the data type of accessDate column a datetime, or is it a string? if it is datetime then try the following:

'SELECT * FROM `statisticData`
 WHERE  (accessDate BETWEEN ' . $_POST['StartD'] . ' AND ' . $_POST['EndD']) .
'ORDER BY accessDate ASC'

it should work, i'm now sql guru