简体   繁体   中英

Is this sql query even acceptable?

another dumb question to brighten your day. I have this MySql query and, yes, it doesn't shown any result. What's wrong here? Is it the AND or the ORDERBY? hmmm...

 SELECT * FROM statisticData WHERE SYear LIKE '$SYr' AND accessDate BETWEEN '$startDate' AND '$endDate' ORDER BY accessDate DESC

Oh, this is what comes before the query:

   $SYr = $_POST['SYr'];
   $startDate = date("m-d-Y", strtotime($_POST['Date1']));
   $endDate   = date("m-d-Y", strtotime($_POST['Date2']));

所需的投入

Dates in MySQL must be in Ymd format. mdY is not acceptable and will not return any rows.

XKCD

Also:

XKCD

Escape your inputs. Its okay for the date ones because you're handling them already and the output is a PHP-generated date. But $SYr is currently unsafe.

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM