在mysql where子句中使用html输入类型月份的值

Question

I have a HTML input type month, like

<input name="month" type="month" />

query

$bywherecls="WHERE DATE_FORMAT(fromdate, '%Y %m') = '".$_GET['month']."'";

value of $_GET['month'] is like 2016-08

what is wrong with the query above?

Answer 1

Your format should be %Y-%m, not %y %m.
With your current code you are checking WHERE 'YYYY MM' = '2016-08', which will never return any results.

$bywherecls="WHERE DATE_FORMAT(fromdate, '%Y-%m') = '".$_GET['month']."'";

And you should never send data directly from the user to the database. use some escape function or use prepared statements.