Variables within an SQL Query

[clodhoppers18]

Im sorry about posting in the other thread, but its a lot like the problem in

http://www.tek-tips.com/viewthread.cfm?qid=1328658.

I am trying to execute something like he is, however I havent had my problem resolved with the solution that was given in the other thread. Please note I am new to PHP so there very well maybe another error that is causing it to go whack.

Basically I am pulling a list of flights from a database and running them through an "application" (if I could call it such a thing) that is later down the page. This list of flights that will be run through will only be ran once, then will never need to go through it again. So I devised a way to have the script start off by calling the last modified time from a different table into the query which will execute and pull in flights that have not been run. The flights have a timestamp on each one, and that is what I am using to pull them out by(assuming everything works correctly).

I have a script at the bottom of the page which updates the last modified time that is in the fspay table with the id of 1, thereby allowing me to call that time in the next time the script is run.

Here it is after I attempted to make the adjustments as noted here in this topic:
37|$lastrun = 'SELECT * FROM `fspay` WHERE CONVERT( `fspay`.`id` USING utf8 ) = \'1\' LIMIT 1 ;';
38|$lastquery = @mysql_query($lastrun);
39|$lasttime = mysql_fetch_array($lastquery, MYSQL_ASSOC);
40|$oldtime = $_GET['time']
41|$querystamp = "SELECT * FROM `flights` WHERE `datestamp` & gt ; = \ '".$oldtime."\' LIMIT 0, 30 ";
42|$result=@mysql_query($querystamp);if(!$result){echo "SQL Error - ".mysql_error();return;}

Here is the error code I get:
Parse error: syntax error, unexpected T_VARIABLE in /home/user/domains/mydomain.com/public_html/1.php on line 41

 

[jpadie]

try this instead

$querystamp = "SELECT * FROM flights WHERE `datestamp` >=  '".mysql_real_escape_string(trim($oldtime))."' LIMIT 0, 30 ";

some thoughts

+ you do not need to escape single quotes inside of double quotes or vice versa
+ variables are expanded with double quotes but are not expanded within single quotes. when we say 'within' we are talking about the outermost set of quotes.
+ it's always worth escaping variables unless you are certain of their provenance. in this case you get the variable from the querystring so cleansing it is vital.
+ you do not test that $_GET['date'] is in a valid format or is even a valid date. this may well lead to unforeseen results.
+ i generally prefer manipulating dates and times as floating point numbers (e.g. unix epoch values rather than formatted dates).

 

[vacunita]

Don't know if it was a typo or not, but you are missing a semi colon in this line:

40|$oldtime = $_GET['time'][red]<<[/red]

----------------------------------
Ignorance is not necessarily Bliss, case in point:
Unknown has caused an Unknown Error on Unknown and must be shutdown to prevent damage to Unknown.

 

[jpadie]

that would certainly explain the error he was getting!

the sql call would have failed too, i think!