Question

I have 3 dropdowns on a form for the user to choose their birthday. One for date, one for month and one for year.

Right now I cam preparing the date given by the user like this:

$date = sanitize($_POST['year']).'-'.sanitize($_POST['month']).'-'.sanitize($_POST['day']);

and inserting $date into the database in a DATE field. I want to be able to do operations based on this field’s values, like sorting by date etc…

Is this the right way to prepare the data or should there not be any hyphens?

Answer 1

According to the MySQL manual page on DATE, the proper format is 'YYYY-MM-DD', so this appears as if it would work and allow you use all of the MySQL date and date comparison operations and functions.

However, you should consider validating user input before sending it to the database (never trust the security or validity of user input). Maybe you should run it through PHP’s date() to make sure that the date you are inserting is valid:

$date = date('Y-m-d', strtotime($_POST['month'].'-'.$_POST['day'].'-'.$_POST['year']));