Prepared statement not working when binding it with sql functions

Question

Schema

id Primary  int(11)         No  None        AUTO_INCREMENT  
creation_date_time  datetime    
exp int(11)

Code

$now = 'now()';
$interval2 = 'now() + Interval 2 day';
$interval1 = 'now() + Interval 1 day';

if($stmt = $conn->prepare("SELECT * FROM xx WHERE creation_date_time >= ? AND creation_date_time <= ? AND creation_date_time > ?")) {
  $stmt->bind_param("sss", $now, $interval2, $interval1);
  $stmt->execute();
  $result = $stmt->get_result();
  print_r($result);
}

It works without prepared statement. Why does this not work and is there a need to use prepared statement in this case at all?

ADyson · Accepted Answer · 2021-10-02 07:37:26Z

2

It doesn't work because you're trying to parameterise SQL code, not just a variable value. Therefore it gets treated as text instead of code.

Since you're not including variable input data in your query, there is no need to use parameters in this case at all.

answered Oct 2, 2021 at 7:37

ADyson

62.9k16 gold badges88 silver badges100 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Prepared statement not working when binding it with sql functions

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related