3

I am working on Drupal 6. while executing query when I add
and FROM_UNIXTIME(o.created,'%d-%m-%Y') < '".arg(3)."'";
to WHERE clause it doesn't return result. i have tried by using same query in MySQL Query Browser it returns result. so I am confused how to pass above condition in WHERE clause,
as I am passing 31-10-2012 in arg(3).

2 Answers 2

4

You just need to escape the percent sign with another, i.e.,

FROM_UNIXTIME(o.created,'%%d-%%m-%%Y')

Also make sure you use parameter replacement rather than injecting strings directly into the query; you're not protected from SQL injection at the moment.

That would be something like

$sql = "SELECT * FROM {table} WHERE FROM_UNIXTIME(o.created,'%%d-%%m-%%Y') < '%s'";
$result = db_query($sql, arg(3));
2
  • i am using ($conditions .= " and FROM_UNIXTIME(o.created,'%%d-%%m-%%Y') >'".arg(2). "'" ;) and at end i append $conditions to my query. n hope it prevent SQL Injection.
    – Sanjay dev
    Oct 18, 2012 at 7:37
  • It won't prevent SQL injection unless you sanitise the argument, the method you're currently using means you're definitely susceptible to an injection attack
    – Clive
    Oct 18, 2012 at 11:48
2

In this question https://drupal.stackexchange.com/questions/149472/addexpression-and-from-unixtime-format, I asked the same question but in relation to Drupal 7 and the addExpression method of the SelectQuery object.

Problem Code:

$query->addExpression('FROM_UNIXTIME(w.submitted, "%Y-%m")', 'Date');

Solution (reverse the quotes):

$query->addExpression("FROM_UNIXTIME(w.submitted, '%Y-%m')", 'Date');

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.