Question

I’m having some trouble with what I believe should be some fairly simple PHP. It’s run inside of WordPress, but the question shouldn’t be WordPress specific. The $wpdb->get_results() is just a way to query the WordPress database without having to use a connection string. I also use a couple of $_GET commands.

Here’s what I have so far:

$Data = $wpdb->get_results("SELECT *
    FROM database.table
    WHERE sem.MonthNum >= " .$_GET["minMonth"]. "
    AND sem.MonthNum <= " .$_GET["maxMonth"]. "
    AND sem.Year  >= " .$_GET["minYear"]. "
    AND sem.Year <= " .$_GET["maxYear"]. ");

This works, so long as the $_GET is populated. I’d like to add a kind of default value such that if $_GET is empty, a number is set, and if it’s not empty, it grabs that number. Something along the lines of…

$Data = $wpdb->get_results("SELECT *
    FROM database.table
    WHERE sem.MonthNum >= " if(!$_GET){echo 1;} else {echo ".$_GET[\"minMonth\"]. "} "

But that doesn’t work for me…probably some silly PHP syntax error, I’m not sure about all the echo statements and the quotes within other quotes and whatnot.

Answer 1

For each of your variables do this:

$minMonth = isset($_GET["minMonth"]) ? intval($_GET["minMonth"]) : 1;
... 
"WHERE sem.MonthNum >= " .minMonth. "

The intavl() call will make convert the $_GET value to an integer if it is not already, which will protect you from SQL injection security issues. If you need to do something similar with strings, use something like mysql_escape_string() instead.