0
$query1 = "UPDATE {$this->_vdmfInstance->sqltable('mod_calendar_repetitions')} set start=(DATE_FORMAT(CONCAT(date(start),'',DATE_FORMAT(".$from->format('Y-m-d H:i:s').",'%H.%i.%S')),'%Y-%m-%d %H:%i:%S') ), 
            end = (DATE_FORMAT(CONCAT(date(end),'',DATE_FORMAT(".$till->format('Y-m-d H:i:s').",'%H.%i.%S')),'%Y-%m-%d %H:%i:%S')) where event_id =".$repId;

This is my actual output from php and how to remove the escape strings ().

'UPDATE `mod_calendar_repetitions` set start=(DATE_FORMAT(CONCAT(date(start),\'-\',DATE_FORMAT(2015-09-14 15:00:00,\'%H.%i.%S\')),\'%Y-%m-%d %H:%i:%S\') ), 
            end = (DATE_FORMAT(CONCAT(date(end),\'\',DATE_FORMAT(2015-09-14 16:15:00,\'%H.%i.%S\')),\'%Y-%m-%d %H:%i:%S\')) where event_id =380;'
Sibi Mani
  • 83
  • 1
  • 9
  • 1
    Don't escape. Use bound parameters. This is relevant: http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1 – rjdown Sep 12 '15 at 17:09
  • ok But I don't know why am getting the \ between the ''. How to remove this. Is my syntax is wrong? @rjdown – Sibi Mani Sep 12 '15 at 17:13
  • How are you seeing that? You didn't put the backslashes in the assignment, it shouldn't appear when you use `echo`. – Barmar Sep 12 '15 at 17:14

1 Answers1

0

Need to mention $from and $till in between the single quotes.

$query1 = "UPDATE {$this->_vdmfInstance->sqltable('mod_calendar_repetitions')} set start=(DATE_FORMAT(CONCAT(date(start),'',DATE_FORMAT('".$from->format('Y-m-d H:i:s')."','%H.%i.%S')),'%Y-%m-%d %H:%i:%S') ),
end = (DATE_FORMAT(CONCAT(date(end),'',DATE_FORMAT('".$till->format('Y-m-d H:i:s')."','%H.%i.%S')),'%Y-%m-%d %H:%i:%S')) where event_id =".$repId;
Sibi Mani
  • 83
  • 1
  • 9