Not able to get from date - php

Question

if i enter two different values i am getting the date to_date value in from_date value
$to_date=$_POST['date'];
$from_date=$_POST['date'];
$query="SELECT * FROM reports WHERE date BETWEEN $from_date AND $to_date";
$query_run = mysql_query($query);
$qty= 0;
while ($num = mysql_fetch_assoc ($query_run)) {
$qty += $num['amount'];
}
echo $qty;
what is the right way to do

Answer 1

First of all, use mysqli_* or PDO, because mysql_* is deprecated and closed in PHP 7.
In your code you need to use quotes around $from_date and $to_date.
One more thing, if your start and end date is same than don't know why are you using BETWEEN, you can just simply use =.
Here is the complete example of your code by using MYSQLi Object Oriented:
<?php
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$to_date = $conn->real_escape_string($_POST['date']);
//$from_date = $conn->real_escape_string($_POST['date']);
$sql = "SELECT * FROM reports WHERE date = '$to_date'";
$result = $conn->query($sql);
$qty = 0;
if ($result->num_rows > 0) {
/* fetch associative array */
while ($row = $result->fetch_assoc()) {
$qty += $row['amount'];
}
echo $qty;
}
else
{
echo "No record found";
}
$conn->close();
?>
Also note that, if this query is just for getting total amount no other use, than you can use your query like:
SELECT SUM(amount) FROM reports WHERE date = '$to_date'
Update:
As per Mr. Magnus suggested, here is the basic example of Prepared Statements.
From the Manual: The user input is automatically quoted, so there
is no risk of a SQL injection attack.
<?php
$sql = "SELECT * FROM reports WHERE date = ?";
$stmt = $conn->prepare($sql);
if ($stmt->execute(array($_POST['date']))) {
while ($row = $stmt->fetch()) {
// your stuff
}
}
?>