Re: SQL Date Range

[James Perkins <jrperkinsjr@xxxxxxxxx>]

I'm not familiar with PHP other than knowing what it is/does, but generally
speaking creating SQL scripts in a string is dangerous. It opens you up to
SQL injection attacks. Not sure if PHP can handle prepared statements, but
you are much safer using those.
--
James R. Perkins


On Wed, Jan 13, 2010 at 08:15, Shannon ODonnell <
sodonnell@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

> I want to select a group of dates based on date range in a PHP app from a
> MySQL database.
>
>
>
> Assume the table name is  xmittalheader and the date field is named:
> XMittalDate and is in the format in the MySQL table like this:   11/02/2009
>
>
>
> Further assume $startDate and $endDate are being brought into the PHP via a
> POST from a form.
>
>
>
> Would this be the correct syntax?
>
>
>
>
>
> $results = mysqli_query($db, "SELECT * FROM xmittalheader WHERE XMittalDate
> BETWEEN ".$startDate." and ".$endDate);
>
>
>
>
>
> Thanks!
>
>
>
>
>
> Shannon O'Donnell
>
>
>
>
>
> --
> This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.