Simple date validation with mysql data

Question

I have this simple date validation where the user cannot input the date if the input in the field is less than the date in the query

I have this code:

if (isset($_POST['btnsubmit'])) {

$date1 = date('Y-m-d', strtotime($_POST['date1']));
$reading = $_POST['reading']; 
$suggest = $_POST['suggest'];
$part =$_POST['part'];

 $sql2 = "SELECT dateinput FROM sched ORDER BY date DESC LIMIT 1";
 $sql = "SELECT reading FROM sched ORDER BY reading DESC LIMIT 1";
 $result = mysqli_query($sqli, $sql);
 if ( $result === FALSE )
 {
    echo mysql_error();
    exit;
}                   
                    $row = mysqli_fetch_object($result);                    
                    if (empty($_POST['reading']))
                    {
                    echo "No Input ";
                    exit;
                    }
                    if ($_POST['reading'] <= $row->reading) 
                    {
                    echo "Must input higher value than {$row->reading}";
                    exit;
                    }
                    if ($_POST['reading'] > $row->reading)
                        {
                            $result2 = mysqli_query($sqli, $sql2);
                            $row2 = mysqli_fetch_object($result2);
                            $try2 = date('Y-m-d', strtotime($row2));
                            if ($_POST['date1'] <= $row2->dateinput)
                            {
                                echo "Must input higher value than {$row2->dateinput}";
                                exit;
                            }
                            elseif ($_POST['date1'] > $row2->dateinput)
                            {
                                $query = mysqli_query($sqli,"INSERT INTO sched (dateinput,reading,suggest,part) VALUES ('$date1','$reading','$suggest','$part')");
                            }
                            else ($_POST['date1'] == date('Y-m-d', strtotime($_POST['1970-01-01'])));
                            {
                                echo "No Input";
                                exit;
                            }
                        }



        }



            }

The result is: If I have correct input (meaning higher than the latest query) the INSERT executes. But if I input wrong data (meaning lower than the latest query) the echo does not execute. What's the problem with this?

did your caps get stuck while typing that title? that won't get you better exposure you know. — Funk Forty Niner, Mar 07 '16 at 22:01
@Fred-ii- Im so sorry my bad, this will not be happening again — John Paul, Mar 07 '16 at 22:04
Isn't `$try2` a string, not an object? `strtotime` should be taking `$row2->dateinput`. You should also use prepared statements, this is open to SQL injections. — chris85, Mar 07 '16 at 22:06

score 1 · Answer 1 · edited May 23 '17 at 11:45

Try this:

if (isset($_POST['btnsubmit'])) {

    $date1 = date('Y-m-d', strtotime($_POST['date1']));
    $reading = $_POST['reading']; 
    $suggest = $_POST['suggest'];
    $part =$_POST['part'];

    $sql = "SELECT reading FROM sched ORDER BY reading DESC LIMIT 1";
    $result = mysqli_query($sqli, $sql);
    if ( $result === FALSE )
    {
        echo mysqli_error();
        exit;
    }                   

    $row = mysqli_fetch_assoc($result);                    

    if (empty($_POST['reading']))
    {
        echo "No Input ";
        exit;
    }

    if ($_POST['reading'] <= $row['reading']) 
    {
        echo 'Must input higher value than {'.$row['reading'].'}';
        exit;
    }

    if ($_POST['reading'] > $row['reading'])
    {
        $sql2 = "SELECT dateinput FROM sched ORDER BY date DESC LIMIT 1";
        $result2 = mysqli_query($sqli, $sql2);

        $row2 = mysqli_fetch_assoc($result2);
        // $try2 = date('Y-m-d', strtotime($row2)); what is this?

        if ($_POST['date1'] <= $row2['dateinput'])
        {
            echo 'Must input higher value than {'.$row2['dateinput'].'}';
            exit;
        }

        elseif ($_POST['date1'] > $row2['dateinput'])
        {
            $query = mysqli_query($sqli,"INSERT INTO sched (dateinput,reading,suggest,part) VALUES ('$date1','$reading','$suggest','$part')");
        }

        else
        {
            echo "Check your Input";
            exit;
        }
    }

}

And you should look at this:

How can I prevent SQL injection in PHP?

: mysqli_fetch_object() expects parameter 1 to be mysqli_result, boolean given AND Trying to get property of non-object — John Paul, Mar 07 '16 at 22:49

Simple date validation with mysql data

1 Answers1