Filter database fields by date - php

Question

I have a page that shows user activity, I have built a form where the user can filter this by date.
Here is the form
<form action='filter_activity.php' method='get'>
From: <input type='text' name='from' value='dd/mm/yyyy'>
To: <input type='text' name='to' value='dd/mm/yyyy'>
<input type='submit' value='Filter'>
Here is the filter_activity.php page:
$from=$_GET["from"];
$to=$_GET["to"];
$result=mysql_query("SELECT * FROM member WHERE personID=$user AND created between $from and $to ");
However this shows nothing, can anyone help?

Answer 1

Your posted dates are in invalid format for DB use. You need to convert them before use in DB.
$from = DateTime::createFromFormat('d/m/Y', $_GET['from']);
$to = DateTime::createFromFormat('d/m/Y', $_GET['to']);
$sql = "
SELECT *
FROM member
WHERE personID = $user AND created BETWEEN '%s' AND '%s'
";
$sql = sprintf($sql, $from->format('Y-m-d'), $to->format('Y-m-d'));
Plus, you should check if $_GET keys exists and after that, check if $from and $to are DateTime object, and not false.

Answer 2

you need to cast it to date like:
$result=mysql_query("SELECT * FROM member WHERE personID=$user AND created BETWEEN DATE('$from') AND DATE('$to')") or die(mysql_error());
from the site :
For best results when using BETWEEN with date or time values, use CAST() to explicitly
convert the values to the desired data type. Examples: If you compare a DATETIME to two
DATE values, convert the DATE values to DATETIME values.
If you use a string constant such as '2001-1-1' in a comparison to a DATE,
cast the string to a DATE.

Answer 3

Pass the correct date format to the DB:
$from = date('Y-m-d', strtotime(str_replace('/', '-', $_GET["from"])));
$to = date('Y-m-d', strtotime(str_replace('/', '-', $_GET["to"])));
$result = mysql_query("SELECT * FROM member WHERE personID=$user AND created BETWEEN '$from' AND '$to'");
Really think about changing the format in your form. I would use a date picker, either year/month/day dropdowns or javascript.
Also, read the other comments about quoting, SQL injection, etc. And get off of mysql_* functions.