Inserting Date to Database - php

Question

I'm trying to insert a date of birth into the database just one table but it's inserting 0000-00-00. I have a form that takes a date input or where <input type="date">. My insert command is:
if (($myname = $_GET['your_name']) && ($phone = $_GET['phone']) &&
($dob = date('Y-m-d', strtotime($_GET['dob'])))) {
$command = "INSERT INTO form_data (id, name, phone, dob)
VALUES ('', '".$db->real_escape_string($myname)."',
'".$db->real_escape_string($phone)."', '".$db->$dob."')";
My script works except the $dob. How do you handle an HTML5 input "date" input type into the database correctly? (I searched but didn't seem to work when I tried their suggestions here).

Answer 1

You assign date('Y-m-d', strtotime($_GET['dob']) to $dob, but later you try to reference it as $db->$dob. What you probably want it so to handle it just like the other variables and use $db->real_escape_string($dob):
$command = "INSERT INTO form_data (id, name, phone, dob)
VALUES ('', '".$db->real_escape_string($myname)."',
'".$db->real_escape_string($phone)."', '".$db->real_escape_string($dob)."')";
To make it more readable, I'd use sprintf though.
$command = sprintf("INSERT INTO form_data (id, name, phone, dob) VALUES ('', '%s', '%s', '%s')",
$db->real_escape_string($myname),
$db->real_escape_string($phone),
$db->real_escape_string($dob));

Answer 2

I suggest formatting your code so it's easier to read, and not doing assignments inside if blocks.
$myname = $_GET['your_name'];
$phone = $_GET['phone'];
$dob = strtotime( $_GET['dob'] );
if( !empty( $myname ) && !empty( $phone ) && $dob !== false ) {
$dob = date('Y-m-d', $dob );
$stmt = $dbConnection->prepare('INSERT INTO form_data ( id, name, phone, dob ) VALUES ( \'\', ?, ?, ? )');
$stmt->bind_param('s', $myname);
$stmt->bind_param('s', $phone);
$stmt->bind_param('s', $dob);
$stmt->execute();
$result = $stmt->get_result();
}
Note how I use mysqli instead of mysql_. It's safer.

Answer 3

By using $db->$dob in your VALUES set you're trying to access a member of $db called whatever value $dob is set to. You should be using $dob instead.