0

I have a problem with my script, when I try :

$sql = "SELECT * FROM logs WHERE time_activation!= '2022-03-20'";

It's works !But if I use a variable, it doesn't work :

$today = date("Y-m-d");
$sql = "SELECT * FROM logs WHERE time_activation!= $today";

I have try this :

$sql = "SELECT * FROM logs WHERE time_activation!= `$today`";

and this :

$sql = "SELECT * FROM logs WHERE time_activation!= #$today#";

Nothing works :( could you help me please

GOLDBUZZ
  • 1
  • BUT Your script will be open to [SQL Injection Attack](http://stackoverflow.com/questions/60174). Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187) You should always use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) in either the `MYSQLI_` or `PDO` API's instead of concatenating user provided values into the query. Never trust ANY user input! – RiggsFolly Mar 20 '22 at 17:22
  • I use prepare request and pdo.... I simplified for the example... – GOLDBUZZ Mar 20 '22 at 17:25
  • Then `WHERE time_activation!= :today"` then `prepare()` and then `bindParam()` then `execute()` – RiggsFolly Mar 20 '22 at 17:27

0 Answers0