在1个MySQL查询中合并2个下拉列表的值

Question

I have the code below, which I want to use to combine the month and date values of the drop-down list, in a MySQL query, so I can filter by date.

<form action="" method="post">
<label class="custom-select">
<select name="q">
<option value="">Selecione o Mês:</option>
<option value="MONTH(post_date) = 1''">Jan</option>
<option value="MONTH(post_date) = 2''">Feb</option>
<option value="MONTH(post_date) = 3''">Mar</option>
<option value="MONTH(post_date) = 4''">Apr</option>
<option value="MONTH(post_date) = 5''">May</option>
<option value="MONTH(post_date) = 6''">Jun</option>
<option value="MONTH(post_date) = 7''">Jul</option>
<option value="MONTH(post_date) = 8''">Aug</option>
<option value="MONTH(post_date) = 9''">Sep</option>
<option value="MONTH(post_date) = 10''">Oct</option>
<option value="MONTH(post_date) = 11''">Nov</option>
<option value="MONTH(post_date) = 12''">Dez</option>
</select>
</label>
<label class="custom-select">
<select name="q">
<option value="">Selecione o Ano:</option>
<option value="AND YEAR(post_date) = 2013">2013</option>
<option value="AND YEAR(post_date) = 2014">2014</option>
<option value="AND YEAR(post_date) = 2015">2015</option>
</select>
</label>
<input name="submit2" id="submit2" style="margin-left: 15px;" type="submit" value="Pesquisar">
</form>

<?php 
if ($_POST['q'] == '') {
    $q = 'YEAR(post_date) = YEAR(CURDATE())';
}
else {
    $q = $_POST['q'] ;
}

$query=mysql_query("SELECT *, 'Yield'
FROM wp_posts
WHERE p.post_status = 'publish' AND ".$q." 
LIMIT 0, 2500")
?>

This is not working, I get the error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AND YEAR(post_date) = 2014

Can someone help. Thanks

Answer 1

This is a very bad way to solve the problem. Among other things, you're depending on the field values to come back in the right order, which isn't guaranteed. It's also trivial to attack this with SQL injection.

But to answer your question: the '' after the MONTH() clause is probably messing things up. Your query is probably coming out as

SELECT *, 'Yield'
FROM wp_posts
WHERE p.post_status = 'publish' AND MONTH(post_date) = 6''AND YEAR(post_date) = 2014

But there's no easy way to fix that without making bad code worse.