Unix_Timestamp from database

Question

On my website I have made a automatic invoice system. It will generate a invoice for a certain user from a certain month. You can select the user, month and year and then click generate.

But, In my MYSQL Database, I've stored the products the user ordered on date with a Unix Timestamp. now I want to load all the products from a certain month by checking if the Unix Timestamp matches. But it won't work.

My code:

require "connect.php";
$create_by=$_GET['user'];
$jaar=$_GET['jaar'];
$maand=$_GET['maand'];
$number = cal_days_in_month(CAL_GREGORIAN, $maand, $jaar);
$result = mysql_query("SELECT *
FROM `mrbs_entry`
WHERE start_time >= UNIX_TIMESTAMP(".$jaar."-".$maand."-01)
AND start_time <= UNIX_TIMESTAMP(".$jaar."-".$maand."-".$number.")
AND create_by = '".$create_by".' 
ORDER BY `start_time`, `room_id`");

The date is given through the link, like user, maand, jaar.

maand is the month, and jaar is the year.

Is start_time a UNIX timestamp?

Script47
– Script47

2016-01-15 14:23:57 +00:00
Commented Jan 15, 2016 at 14:23 — Script47
– Script47, Commented Jan 15, 2016 at 14:23

Marc B · Accepted Answer · 2016-01-15 14:25:46Z

3

You didn't quote your date values within the query, so effectively you're building

... WHERE start_time >= UNIX_TIMESTAMP(2016-01-15)

That's not a date value, it's a double mathematical subtraction, and you're really executing UNIX_TIMESTAMP(2000), which is way back in 1970.

WHERE start_time >= UNIX_TIMESTAMP('".$jaar."-".$maand."-01')
                                   ^-----------------------^

Note the indicated quotes. And also note that you're wide open for sql injection attacks, so enjoy having your server pwn3d.

answered Jan 15, 2016 at 14:25

Marc B

362k44 gold badges433 silver badges508 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Sven Over a year ago

What do you mean with sql injection attacks

M. Eriksson Over a year ago

I love that xkcd-strip!

Collectives™ on Stack Overflow

Unix_Timestamp from database

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related