在codeigniter中向SQL注入一个SQL

Question

I am trying to inject a SQL with a DATE_FORMAT method and it gives me parsing error. But the query working perfectly in phpmyadmin. Below you can find my code which is my controller

public function index() {
  $sql = "SELECT DATE_FORMAT('added_date', "%M") AS Month, SUM(total) FROM tbl_order GROUP BY DATE_FORMAT('added_date', "%M")";
  $query = $this->db->query($sql);
  $orderData= $query->result_array();
  $data["orderData"] = $orderData;
  var_dump($data);die;
  $this->load->view('admindashboard/index.php',$data);
}

I have attached the error message as well

Answer 1

I think you can try to use '%M' instead of "%M", because it will split the string by ".

$sql = "SELECT DATE_FORMAT(added_date, '%M') AS Month, 
SUM(total) 
FROM tbl_order 
GROUP BY DATE_FORMAT(added_date, '%M')";