validate $_POST['date'] to compare to SQL server date column

Question

I have some code where I want to pull code from the database where the date matches the date that the user selected. The column on the SQL server end is a Date parameter. Below is my code where I try to SELECT a record where the user imputed date matched the date in the record on the database. However I am getting error every time I get tot he $stmt = $dbh->query($sql) line i get the error call back. I have tried echoing $sql from the below line of code

$sql = "SELECT * FROM tblEmployee WHERE  dtDate = " . $selected_date;

and on sql server I get "Operand type clash: date is incompatible with int". Below is my code

if(isset($_POST['submit'])){

           try{
                $dbh = new PDO('sghf','','');

                $dbh->setAttribute ( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );

                $selected_date = date('Y-m-d', strtotime($_POST['dateFrom']));
                $selected_option= $_POST['iChoiceID'];
                $returnVals = array ();

                $sql = "SELECT * FROM tblEmployee WHERE  dtServed = " . $selected_date;
                //echo $sql;
               $stmt = $dbh->query($sql);


               //$sourceInfo = $stmt->fetch( PDO::FETCH_ASSOC);
                /*
                $returnVals['info'] = array();
                $returnVals['info'] ['txtInfo'] = $sourceInfo ['txtInfo'];
                $returnVals['info'] ['txtName'] = $sourceInfo ['txtName'];
                $returnVals['info'] ['txtOther'] = $sourceInfo ['txtOther'];
                $stmt->closedCursor();
                */


            }catch ( PDOException $e ) {
                echo "error";
    }

I would just like to know if there is a way of verifying they are the same type. Thanks in advance

You're using PDO but injecting user supplied data instead of prepared statements? — AbraCadaver, May 16 '19 at 20:14
I didn't say _inserting_ I said _injecting_, and though the answer will work it is a horrible and dangerous way to execute a query. — AbraCadaver, May 16 '19 at 20:49

score 1 · Answer 1 · answered May 16 '19 at 20:07

1

Your need quotes around your date expression :

WHERE  dtServed = '" . $selected_date . "'" ;

answered May 16 '19 at 20:07

Joffrey Schmitz

2,393
3
19
28

validate $_POST['date'] to compare to SQL server date column

1 Answers1