Re: SQL Date Range

["Mike Pavlak" <Mike.Pavlak@xxxxxxxx>]

PHP can certainly support prepared statements.  I agree with
escaping/filtering and validating data.  

There are a lot of neat methods for managing this stuff in base PHP and
Zend Framework.

Regards,

Mike

mike.p@xxxxxxxx   Cell: (408)679-1011    Office: (815)722-3454

Zend Server for IBM i Beta avilable at
http://www.zend.com/en/products/server/zend-server-5-new-ibmi 


-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of James Perkins
Sent: Wednesday, January 13, 2010 10:17 AM
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] SQL Date Range

I'm not familiar with PHP other than knowing what it is/does, but
generally
speaking creating SQL scripts in a string is dangerous. It opens you up
to
SQL injection attacks. Not sure if PHP can handle prepared statements,
but
you are much safer using those.
--
James R. Perkins


On Wed, Jan 13, 2010 at 08:15, Shannon ODonnell <
sodonnell@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

> I want to select a group of dates based on date range in a PHP app
from a
> MySQL database.
>
>
>
> Assume the table name is  xmittalheader and the date field is named:
> XMittalDate and is in the format in the MySQL table like this:
11/02/2009
> Further assume $startDate and $endDate are being brought into the PHP
via a
> POST from a form.
>
>
>
> Would this be the correct syntax?
>
>
>
>
>
> $results = mysqli_query($db, "SELECT * FROM xmittalheader WHERE
XMittalDate
> BETWEEN ".$startDate." and ".$endDate);
>
>
>
>
>
> Thanks!
>
>
>
>
>
> Shannon O'Donnell
>
>
>
>
>
> --
> This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.