0

i have a problem with an sql server query , here is the code 

$search = "SELECT TOP (200)DEP_Operation.operationDate, DEP_Products.productRef, DEP_Products.serialNumber, DEP_Devices.deviceName, DEP_Errors.errorDescription, DEP_Errors.errorCode, DEP_RootCause.rootCauseDescription,DEP_Actions.actionDescription,
              DEP_RootCause.rootCauseDescription, DEP_Users.fullName
FROM  DEP_Operation INNER JOIN
           DEP_Actions ON DEP_Operation.actionID = DEP_Actions.id INNER JOIN
           DEP_Devices ON DEP_Operation.deviceID = DEP_Devices.id INNER JOIN
           DEP_Errors ON DEP_Operation.errorID = DEP_Errors.id INNER JOIN
           DEP_Products ON DEP_Operation.productID = DEP_Products.id INNER JOIN
           DEP_RootCause ON DEP_Operation.rootCauseID = DEP_RootCause.id INNER JOIN
           DEP_Users ON DEP_Operation.personInCharge = DEP_Users.id
where operationDate between  (CONVERT(Datetime, '".$_POST['Date_de_debut']".00:00:00.000',120)) and (CONVERT(Datetime, '".$_POST['Date_de_fin']".00:00:00.000',120))";
Brainiac
  • 11
  • 1
  • 8
  • 2
    [Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)*** Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! – Jay Blanchard Nov 06 '17 at 15:33
  • the query is it good?? – Brainiac Nov 06 '17 at 15:42
  • Without all of the code for the query we cannot totally tell, but it appears you have syntax issues. – Jay Blanchard Nov 06 '17 at 15:44
  • the query is too long to be in a comment, the issue is in the line that i wrote in the question. when i replace the variables with the value directly it works also – Brainiac Nov 06 '17 at 15:48
  • Edit the question and add in the entire query. Regardless of that you should use prepared statements which will eliminate 99% of syntax issues in queries. – Jay Blanchard Nov 06 '17 at 15:51
  • it's done @JayBlanchard – Brainiac Nov 06 '17 at 15:52
  • Do you see where you've forgotten to finish the concatenation for the variables in the query? For example `CONVERT(Datetime, '".$_POST['Date_de_debut'].".00:00:00.000',120)` – Jay Blanchard Nov 06 '17 at 15:53
  • no :( can u show me where – Brainiac Nov 06 '17 at 15:55
  • Right after each `$_POST` variable you forget to add an `.` – Jay Blanchard Nov 06 '17 at 15:56

0 Answers0