PHP/MySQL - date

[john010117]

Hello. I have the following code so far.


<?php
// Connection information
$db_host = "localhost";
$db_user = "***";
$db_pass = "***";
$db_name = "***";

// Connect to server
$dbac = mysql_connect($db_host,$db_user,$db_pass);
$today = getdate();

// Select database
mysql_select_db ($db_name) or die ("Cannot connect to database");

// Change is here added [ = '{$_GET['date']}' ] to end. Which get ?date=____ from url.
$result = mysql_query("SELECT * FROM news WHERE Date = '{$_GET['date']}' ORDER BY Time");

$curtime = time();

if ($result && mysql_num_rows($result)) {
$numrows = mysql_num_rows($result);
$rowcount = 1;

while ($row = mysql_fetch_assoc($result)) {

while(list($var, $val) = each($row)) {
print "<B>$var</B>: $val<br />";
}

print "<br />";
++$rowcount;
}
}
?>


As you can see, it stores information in a table called "news". If I type in index.php?date=2007-01-06, it gets the news only for that day.

I was wondering. How can I make it so that when I type in index.php, it automatically gets the news for today (but I'm typing up the news). Anybody know how to?

[Buzz]

if (!isset($_GET['date'])) {
$dtm= date('Y-m-d');
} else {
$dtm = $_GET['date'];
}


Then replace the $_GET['date'] in the query with $dtm

Always a BAD BAD BAD idea to let GET variable go straight to a query. You should filter them somewhat to prevent malicious hacking.

[john010117]

Should I just add that code into my existing code, or replace it with something (sorry, I'm a beginner at php)?

[oracle128]

Put it above the $result = .... line, and in that line, replace $_GET['date'] with $dtm. And don't forget to validate $dtm to ensure it's a proper date as per Buzz's advice, or you're guaranteed be a victim of SQL injection (http://en.wikipedia.org/wiki/Sql_injection).

[john010117]

It only shows a blank page...

[Buzz]

I left out a bracket earlier... check the code now.


<?php
// Connection information
$db_host = "localhost";
$db_user = "***";
$db_pass = "***";
$db_name = "***";

// Connect to server
$dbac = mysql_connect($db_host,$db_user,$db_pass);
$today = getdate();

// Select database
mysql_select_db ($db_name) or die ("Cannot connect to database");

if (!isset($_GET['date'])) {
$dtm= date('Y-m-d');
} else {
$dtm = trim($_GET['date']);
}

// Change is here added [ = '$dtm' ] to end. Which get ?date=____ from url.
$result = mysql_query("SELECT * FROM news WHERE Date = '$dtm' ORDER BY Time");

$curtime = time();

if ($result && mysql_num_rows($result)) {
$numrows = mysql_num_rows($result);
$rowcount = 1;

while ($row = mysql_fetch_assoc($result)) {

while(list($var, $val) = each($row)) {
print "<B>$var</B>: $val<br />";
}

print "<br />";
++$rowcount;
}
}
?>


You should still add some checks for $_GET['date'] to be certain it's 10 characters long and is formatted properly.

[john010117]

Ok. It shows the news for today when I just typed in index.php, but when I typed in index.php?Date=2007-01-10, it still showed today's article.

[Buzz]

Okay try this:

replace

if (!isset($_GET['date'])) {
$dtm= date('Y-m-d');
} else {
$dtm = trim($_GET['date']);
}


with this



$dtm = trim($_GET['date']);
if ($dtm=='') { $dtm= date('Y-m-d'); }