在MySQL中的select语句中阻止变量计算

Question

I'm trying to build a dynamic query based upon selections passed to a script. Example:

$qry = "SELECT * FROM machinekaart 
INNER JOIN afleveradressen ON afleveradressen.raaid = mkrraaid 
INNER JOIN kontaktpersonen ON kontaktpersonen.rkpraaid = mkrraaid   
WHERE mkrrid != '' " ;

if($_SESSION['oud'])
    $qry .= "  AND mkrvo < " . $cur_jaar_maand;

Field mkrvo is a text field, and can contain yyyy-mm besides other values.

e.g. when the varable $cur_maand_jaar contains '2015-01' the selection will be everything lower than 2014

How can I stop this from happening and selecting everything lower than '2015-01' ??

Answer 1

I would suggest quoting that variable, so the values are taken literally:

if($_SESSION['oud'])
    $qry .= "  AND mkrvo < '" . $cur_jaar_maand . "'";

Better than that, please use PDO so you can use bindings, it's safer and best optimized.

Eg.

if($_SESSION['oud'])
    $qry .= "  AND mkrvo < ?";

// build your PDO Connection $myPdoConnection ...

$pdoStatement = $myPdoConnection->prepare($qry);

$pdoStatement->execute(array($cur_jaar_maand));