get value from form field to select statement

[ramiwahdan]

Hi,

I have select statement that has where clause with 3 conditions out of which 2 conditions i need to take values from form in the page.

code:

$res = $conn->query("SELECT oracleid
                         , name 
                         , des 
                         , clockingindate
                         , clockingoutdate  
                         , timediff(clockingoutdate, clockingindate) as duration
                         , total
                    FROM attendance_records
                         JOIN (
                                SELECT oracleid
                                     , sec_to_time(sum(timestampdiff(SECOND, clockingindate, clockingoutdate))) as total
                                FROM attendance_records
								where isdone =-1 
                                GROUP BY oracleid
                              ) tots USING (oracleid)
							  where isdone =-1 and DATE(ClockingOutDate) >= $sdate1 and DATE(ClockingOutDate) <= $edate1
                    ORDER BY oracleid, clockingindate
                    ");

and the form fields names are assigned to variables sdate1 and edate1

code:
 

	<Center>
	
	<h2>Please enter start date and end date:</h2>
	
	</center>
	<form action="#" method="post">
	
	<center>
	<h5>Start Date:<input type="date" name="sdate" placeholder = "Start Date" required="required"></input>
	End Date:<input type="date" name="edate" placeholder = "End Date" required="required"></input>
	<input type="submit" name="saveit" value="Generate"></input></h5>
	</center>
	
	</form>

	<div class="container">
		<div class="row">
			<div class="col m-auto">
				<div class="card mt-5">
					<table class="table table-bordered">
					
						<tr>

							<input type="button" onClick="window.print()" value="Print The Report"/>
							<td>OracleID</td>
							<td>Name</td>
							<td>Designation</td>
							<td>Clocking In Time</td>
							<td>Clocking Out Time</td>
							<td>Duration</td>
						
						</tr>
						
<?php


	if (isset($_POST['saveit']))
								
	{

		$sdate1 = $_POST['sdate'];
		$edate1 = $_POST['edate'];

I tried to run the code didn't work but i take off the 2nd and 3rd conditions of where clause, it works.

[Barand]

Use a prepared statement with placeholders and bound parameters

[ramiwahdan]

14 minutes ago, Barand said:

Use a prepared statement with placeholders and bound parameters

thank you for the reply but i am new to php, could you please help me or guide me for examples?