Results aren't being gathered from my database after trying to prevent sql injection

Question

I am currently trying to prevent sql injection by using mysqli statements. However, after completing this transition, I am not getting results from my database anymore. I have a form where users can select economic data by narrowing down year intervals, months out of the year, and a location.Here is my current coding issues:

<?php

if (isset($_POST['submitted'])) {


$gYear = $_POST["year"];
$gYear2 = $_POST["year2"];
$gMonth = $_POST["month"];
$gSelect = $_POST["location"];

if ($gYear > $gYear2) {

die('ERROR: Your second year cant be a time period before the first year you selected');
}

else {

$query = $conn->prepare("SELECT $gSelect, Year FROM unemployed WHERE year BETWEEN ? AND ? and month= ?");
$query->bind_param('sss', $gyear, $gYear2, $gMonth);

$query->execute(); 

$result = = $conn->query($query)

echo"<table>";
echo "<tr><th>Year</th><th>Time</th><th>$gSelect</th></tr>";

while ($row = $result->fetch_object()){


echo "<tr><td>";
echo $row->Year;
echo "</td><td>";
echo $gMonth;
echo "</td><td>";
echo $row->$gSelect;
echo "</td></tr>";

}




echo "</table";

}

} // end of main if statement

?>

It worked before I tried updating my query to prevent injection. I am currently using php 5.2.14 to work on this in case you guys were wondering. Am I missing a statement? Can anyone help me figure out what my issue is? Any help would be greatly appreciated.

$gselect is the locations that the user can choose from. I have a few listed in a drop down menu. They represent a few of my columns in my database. — user2562125, Jul 14 '13 at 03:00

score 0 · Answer 1 · edited May 23 '17 at 10:25

0

$query->get_result()

seems to be unavailable in your version of PHP. See here for a workaround.

Edit: Correction, thanks to comment

edited May 23 '17 at 10:25

Community

1
1

answered Jul 14 '13 at 03:01

santosh.ankr

671
4
12

I have tried get_result(). I don't believe my version of PHP allows it. – user2562125 Jul 14 '13 at 03:01
$stmt->bind_result($col1, $col2); What do the variables on the inside of the parenthesis represent? – user2562125 Jul 14 '13 at 03:15
The values to store the results of each fetch, I believe - see the examples in the docs for [bind_result](http://php.net/manual/en/mysqli-stmt.bind-result.php) – santosh.ankr Jul 14 '13 at 03:22
They don't apply to the columns I am accessing in my database though. – user2562125 Jul 14 '13 at 03:27
Why not? `$query->bind_result($gcolumn, $year); while ($query->fetch()) { printf("%s %s\n", $gcolumn, $year); }` – santosh.ankr Jul 14 '13 at 03:42
I just tried that. It still isn't printing anything. Nothing is showing up. – user2562125 Jul 14 '13 at 03:50

Results aren't being gathered from my database after trying to prevent sql injection

1 Answers1