Avoid substract (-) on number string MYSQL PHP

Question

I have a PHP string

$string = "1167-07-04";
// Yes, looks like a DATE but it´s not.

I´m trying to UPDATE a MYSQL field (varchar)

$sql = "UPDATE table SET `field1` = $string";

But... The problem is that makes a substract and puts the value 1156. I need to put 1167-07-04

Anyone knows HOW? Thanks a lot.

You should be using prepared statements instead of relying on string interpolation to create your sql statements. This code is vulnerable to SQL injection attacks — Orangepill, Sep 04 '15 at 17:25

score 2 · Answer 1 · answered Sep 04 '15 at 17:30

2

The simple answer without any preaching is all string values even when in a variable should be wrapped in quotes. Thats quotes and not backticks.

$sql = "UPDATE table SET `field1` = '$string'";

answered Sep 04 '15 at 17:30

RiggsFolly

93,638
21
103
149

samrap · Answer 2 · 2015-09-04T22:45:28.107

0

Firstly, you need to take a look at prepared statements. Please, for the love of software, take a look at prepared statements!! Secondly, your value is a string so you need to put some single quotes around it. Looks like you have a lot to learn about making queries, so here are two links for getting started in PHP:

MySQLi: http://php.net/manual/en/book.mysqli.php

PDO: http://php.net/manual/en/book.pdo.php

I highly recommend taking the time to choose one of these extensions and spending the time to learn them well. There is no room for shortcuts when it comes to working with databases in web applications.

edited Sep 04 '15 at 22:45

answered Sep 04 '15 at 17:28

samrap

5,595
5
31
56

you are completely right. the amount of programming I have done this week has apparently made me into an idiot. let me update that – samrap Sep 04 '15 at 22:45

Avoid substract (-) on number string MYSQL PHP

2 Answers2