Is this query safe to use? Prepared statement? - php

Question

Is this query safe to use? I'm not sure how I'd convert it to a prepared statement as it's not using any values from the user:
$result = mysqli_query($cxn, "SELECT * FROM table WHERE datetime > DATE_SUB(NOW(), INTERVAL 15 DAY) ORDER BY RAND() LIMIT 1");
while ($row = mysqli_fetch_array($result)) {
$title = $row['title'];
echo $title;
}
Is this safe to use? How can I improve it?
Thanks.

Answer 1

Yes, it's safe. There is no user input used there at all; nothing that has the potential to mess up the query syntax or manipulate the outcome in any way.
As for improvements, there is no need to return every field in the table if you are only using the title field. In general, you should avoid the wild-card (*) for SELECT queries, except for testing purposes.
Also, the DATE_SUB(NOW(), INTERVAL 15 DAY) can be reduced to just NOW() - INTERVAL 15 DAY. Shorter and sweeter; no unnecessary function calls.

Answer 2

The biggest improvement you can make is to change
SELECT * FROM table WHERE datetime > DATE_SUB(NOW(), INTERVAL 15 DAY) ORDER BY RAND() LIMIT 1
to
SELECT title FROM table WHERE datetime > DATE_SUB(NOW(), INTERVAL 15 DAY) ORDER BY RAND() LIMIT 1
because you are only using the title column in your code.

Answer 3

Yes it is safe. It's best to use prepared statement if you decided to pass parameter to your sql.
here is example for you with parameter :
$stmt = $dbConnection->prepare('SELECT * FROM employees WHERE name = ?');
$stmt->bind_param('s', $name);
$stmt->execute();
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
// do something with $row
}
here is example/answer for your sql:
$stmt = $dbConnection->prepare('SELECT * FROM table WHERE datetime > DATE_SUB(NOW(), INTERVAL 15 DAY) ORDER BY RAND() LIMIT 1');
$stmt->execute();
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
// do something with $row
}