Using more than one WHERE condition in mysql query - php

Question

I am trying to apply a multiple WHERE conditions to my query just like this:
$hotel="Hotel Name";
$data1=explode('/',$data1);
$newdata1=mktime(0, 0, 0, $data1[0], $data1[1], $data1[2]);
$newdata1=date("Y-m-d", $newdata1);
$data2=explode('/',$data2);
$newdata2=mktime(0, 0, 0, $data2[0], $data2[1], $data2[2]);
$newdata2=date("Y-m-d", $newdata2);
$filtro=mysql_query("SELECT *
FROM hotels_rates_flat
WHERE htl_name = $hotel AND
given_date>=$newdata1 AND
given_date<=$newdata2
ORDER BY htl_name, city_zone, given_date")
or die(mysql_error());
It is returning the following error:
*You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'do Hotel AND given_date>=2012-09-01 AND given_date<=2012-09-05 ORDER BY htl_nam' at line 1.*
This is really bothering me because I can't see any clear mistake.
I would appreciate any help.
Thank you

Answer 1

Use PDO to avoid SQL injections and error reporting:
<?php
$db = new PDO('mysql:host=localhost;dbname=testdb;charset=UTF-8', 'username', 'password', array(PDO::ATTR_EMULATE_PREPARES => false, PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION));
$hotel="Hotel Name";
$data1=explode('/',$data1);
$newdata1=mktime(0, 0, 0, $data1[0], $data1[1], $data1[2]);
$newdata1=date("Y-m-d", $newdata1);
$data2=explode('/',$data2);
$newdata2=mktime(0, 0, 0, $data2[0], $data2[1], $data2[2]);
$newdata2=date("Y-m-d", $newdata2);
try {
$stmt = $db->query("SELECT * FROM `hotels_rates_flat` WHERE `htl_name` = :hotel AND (`given_date` BETWEEN :date1 AND :date2) ORDER BY `htl_name`, `city_zone`, `given_date`");
$stmt->execute(array(':hotel' => $hotel,':date1' => $newdata1,':date2' => $newdata2));
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);
} catch(PDOException $ex) {
echo $ex->getMessage();
}
// use $results
?>

Answer 2

The source of your problem is quoting. You should use a prepared statement with placeholders, and let the mysql driver figure out how to insert the values in a syntactically valid way.
You can use mysqli_ functions similarly to mysql_ ones, and just add a couple extra calls to handle the parameters. You do need an explicit database handle (I call it $dbh below; it's returned from mysqli_connect()) instead of relying on an implicit one like the mysql_ functions let you do.
$stmt = mysqli_prepare($dbh, 'SELECT * FROM hotels_rates_flat'
. ' WHERE htl_name = ?'
. ' AND given_date BETWEEN ? AND ?'
. ' ORDER BY htl_name, city_zone, given_date');
# the 'sss' means treat all three parameters as (s)trings
mysqli_bind_param($stmt, 'sss', $hotel, $newdata1, $newdata2) or die(mysqli_error($dbh));
$filtro = mysqli_stmt_execute($stmt) or die(mysqli_error($dbh));
Or you could use PDO, as in Mihai's answer, which is a bit different.

Answer 3

You need to encase $hotel, $newdata1 and $newdata2 with single quotes.
SELECT * FROM hotels_rates_flat WHERE htl_name = '$hotel' AND ...
You can also use the BETWEEN operator instead of writing out less than & greater than:
AND given_date BETWEEN '$newdata1' AND '$newdata2'
You should also stop using mysql_ functions.