I have a drop down box set up to allow users to select requirements for economic data. Users can select year choices which creates a time interval, a month, and a location. I am trying to prevent sql injection, but I am having no luck. Here is my code:
[php]
if (isset($_POST[‘submitted’])) {
$gYear = $_POST[“year”];
$gYear2 = $_POST[“year2”];
$gMonth = $_POST[“month”];
$gSelect = $_POST[“location”];
$array = array(‘loc1’ -> ‘Fayette’, ‘loc2’ -> ‘Wayne’, ‘loc3’ -> ‘Indiana’, ‘loc4’ -> ‘US’);
if(array_key_exists($_POST[‘location’], $array)) {
$column = $array[$_POST[‘location’]]
}
if ($gYear > $gYear2) {
die(‘ERROR: Your second year cant be a time period before the first year you selected’);
}
else {
$query = $conn->prepare(“SELECT $column, Year, Month, FROM unemployed WHERE year BETWEEN ? AND ? and month= ?”);
$query->bind_param(‘sss’, $gyear, $gYear2, $gMonth);
$query->execute();
$result = $query->get_result();
echo “
| Year | Month | $column |
|---|---|---|
| ”; echo $row->$column; echo “ |
”; echo $row->Year; echo “ |
”; echo $row->Month; echo “ |
} // end of main if statement
?>
[/php]
Now that I have tried preventing sql injection, when I click the submit button, no data is being displayed. This is the only portion of my code that I have edited, so the error is occurring in here. I can’t seem to figure out what I am doing wrong. Can you guys help me out? Any help would be greatly appreciated.
