将日期插入数据库

Question

I'm trying to insert a date of birth into the database just one table but it's inserting 0000-00-00. I have a form that takes a date input or where <input type="date">. My insert command is:

   if (($myname = $_GET['your_name']) && ($phone = $_GET['phone']) && 
      ($dob = date('Y-m-d', strtotime($_GET['dob'])))) {
   $command = "INSERT INTO form_data (id, name, phone, dob) 
              VALUES ('', '".$db->real_escape_string($myname)."', 
              '".$db->real_escape_string($phone)."', '".$db->$dob."')";

My script works except the $dob. How do you handle an HTML5 input "date" input type into the database correctly? (I searched but didn't seem to work when I tried their suggestions here).

Answer 1

You assign date('Y-m-d', strtotime($_GET['dob']) to $dob, but later you try to reference it as $db->$dob. What you probably want it so to handle it just like the other variables and use $db->real_escape_string($dob):

$command = "INSERT INTO form_data (id, name, phone, dob) 
  VALUES ('', '".$db->real_escape_string($myname)."', 
  '".$db->real_escape_string($phone)."', '".$db->real_escape_string($dob)."')";

To make it more readable, I'd use sprintf though.

$command = sprintf("INSERT INTO form_data (id, name, phone, dob) VALUES ('', '%s',  '%s', '%s')",
  $db->real_escape_string($myname),
  $db->real_escape_string($phone),
  $db->real_escape_string($dob));