[php] Inserting current time into a mysql database

ringo747 · 13 Dec 2006 at 16:00

hi guys as title suggests how can I input the current time into a mysql database?

This is what I have but it doesnt work

Code:

$sql="INSERT INTO $table_name (title, body, username, time_added)
VALUES
('$_POST[title]','$_POST[body]','$_SESSION[username]', 'now()')";

Probably is some stupid mistake. using the above code inputs 00:00 for each entry

Thnx in advance

elkdanger · 13 Dec 2006 at 16:28

Try using NOW() without the single-quotes around it in the SQL statement - any better?

Dr_Evil · 13 Dec 2006 at 16:32

GETDATE ( )

toString · 13 Dec 2006 at 16:32

robmiller said:
Escape your input!!

ringo747 · 13 Dec 2006 at 16:36

elkdanger said:
Try using NOW() without the single-quotes around it in the SQL statement - any better?

worked thanks!

i had set my datatype in the database to time but i changed this. Should it be time?

ringo747 · 13 Dec 2006 at 16:36

KingAdora said:
"Escape your input!!"

sorry what does this mean?? im a newbie!

growse · 13 Dec 2006 at 16:43

Think about what would happen if $_POST[title] was:

'; DROP DATABASE; --

Do a google for SQL injection. Then don't ever put variables straight into SQL statements again. Use paramaterized queries

ringo747 · 13 Dec 2006 at 16:50

growse said:
Think about what would happen if $_POST[title] was:

'; DROP DATABASE; --

Do a google for SQL injection. Then don't ever put variables straight into SQL statements again. Use paramaterized queries

lol, never heard of that before.. just as well this is only for a uni project and wont actually be going live!

So i should change this:

Code:

$sql="INSERT INTO $table_name (title, body, username, time_added)
VALUES
('$_POST[title]','$_POST[body]','$_SESSION[username]', 'now()')";

as this:

Code:

$title = $_POST[title];
$body = $_POST[body];

$sql="INSERT INTO $table_name (title, body, username, time_added)
VALUES
('$title','$body','$_SESSION[username]', 'now()')";

I tihnk i see what your talking about

ringo747 · 13 Dec 2006 at 16:55

actually i dont think iv got it at all!

Dj_Jestar · 13 Dec 2006 at 17:09

http://php.net/mysql_real_escape_string

ringo747 · 13 Dec 2006 at 17:25

thanks v much for the info.. better getting this sorted at the early stages. all the beginners tutorials that i looked at never showed this!

robmiller · 13 Dec 2006 at 17:35

http://php.robm.me.uk/ </pimp>

ringo747 · 13 Dec 2006 at 17:39

thanks rob... can i employ you as a mentor for my whole project??? lol