0

How i can sort out (smart code) this query?

$sql = "SELECT * from  ticket db WHERE db.userid='".$_SESSION['user']."'";
 
        switch ($_GET['tempo']){
            case 1:
                $sql = $sql." AND date(db.DataCriacao)=curdate()";
                break;
            case 2:
                $sql = $sql." AND date(db.DataCriacao)=subdate(curdate(), interval 1 day)";
                break;
            case 3:
                $sql = $sql." AND date(db.DataCriacao)=subdate(curdate(), interval 2 day)";
                break;
            default:
                break;
        }

full code: https://pastebin.com/pqVCj8bc

sqlExec
  • 11
  • 5
  • Subtract 1 from `$_GET['tempo']` and subract `interval $tempo_minus_1 day`. – Barmar Jun 14 '21 at 17:43
  • 1
    Side note: Do not use string interpolation or concatenation to get values into SQL queries. That's error prone and might make your program vulnerable to SQL injection attacks. Use parameterized queries. See ["How to include a PHP variable inside a MySQL statement"](https://stackoverflow.com/questions/7537377/how-to-include-a-php-variable-inside-a-mysql-statement) and ["How can I prevent SQL injection in PHP?"](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). – sticky bit Jun 14 '21 at 18:36

0 Answers0