Get SQL table data for current month using prepared statement PHP - php

Question

Here is a code which I am using to get current month data from table wp_formdata
HTML :
<div class="result" id="result" name="result">
<?php echo $head1; ?> <?php echo $out; ?> <?php echo $head2; ?>
</div>
PHP:
if ($_POST['result_options'] == 'Current_Month') {
$now = new \DateTime('now');
$CurrMonth = $now->format('m');
$CurrYear = $now->format('Y');
$sql ="Select date,select_bank,entry_type,income_cat,expense_cat,amount,expense_cat_sub from wp_formdata WHERE MONTH(?) = MONTH(CURRENT_DATE()) AND YEAR(?) = YEAR(CURRENT_DATE()) order by date ";
$stmt = mysqli_stmt_init($conn);
if(!mysqli_stmt_prepare($stmt,$sql)) {
$message = '<h1 style="color:red;padding-top:5%;">SQL Error !!</h1>';
} else {
mysqli_stmt_bind_param($stmt,"ss", $CurrMonth, $CurrYear);
mysqli_stmt_execute($stmt);
$result= mysqli_stmt_get_result($stmt);
$out = "";
while($row = mysqli_fetch_assoc($result)) {
$out .= "<tr><td>".$row["date"]."</td><td>".$row["select_bank"]."</td><td>".$row["entry_type"]."</td><td>".$row["income_cat"]."</td><td>".$row["expense_cat"]."</td><td>".$row["expense_cat_sub"]."</td><td>".$row["amount"]."</td></tr>";
}
}
}
I verified the database connection and it's working as expected. I also verified the variable $CurrMonth and $CurrYear values:
echo $CurrMonth; //will give output 10
echo $CurrYear; //will give output 2018
But I am not getting any search result. Any suggestions to resolve it?

Answer 1

The month and year comparison in your SQL looks incorrect, you are comparing the current month (and extracting the month from it MONTH(?)) with the month of the current date (MONTH(CURRENT_DATE())). You can get away without using any parameters as you need to compare (I assume) the month of the date from the record (MONTH(date)) with the current month (same for year).
$sql ="Select date,select_bank,entry_type,income_cat,expense_cat,
amount,expense_cat_sub
from wp_formdata
WHERE MONTH(date) = MONTH(CURRENT_DATE())
AND YEAR(date) = YEAR(CURRENT_DATE())
order by date ";
It's always worth checking SQL out in something like PHPMyAdmin to ensure it gives the results your after before running it in PHP.
In case you need to do this for any other month, you can use parameters, but don't extract the month from it...
$sql ="Select date,select_bank,entry_type,income_cat,expense_cat,
amount,expense_cat_sub
from wp_formdata
WHERE MONTH(date) = ?
AND YEAR(date) = ?
order by date ";

Answer 2

You are comparing the PHP current date to the DB current date.
In your SQL string you should replace MONTH(?) and YEAR(?) with MONTH(date) and YEAR(date).
At this point you should remove the mysqli_stmt_bind_param($stmt,"ss", $CurrMonth, $CurrYear); because the SQL string has not parameters.