query does not work

bam_usic

Hi,
I am not sure what I am doing wrong.But could you please have a look on my query
I am passing parameters through query string but it doesn't generate chart.
But if hardcode the same values as below $from and $to it generates the chart.There is no problem with pid field.It picks it properly.

$pid=$GET["pid"];
$from=$GET['from'];
$to=$_GET['to'];

#$pid=20;
#$from='2006-12-04';
#$to='2010-04-19';

echo $pid;
echo $from;
echo $to;

// Fetch all factory records
$strQuery = "select rid,meter_dtg from readings where pid=$pid and meter_dtg >= '$from' and meter_dtg <= '$to';";
I also tried
#$strQuery = "select rid,meter_dtg from readings where pid='".$pid ."' and meter_dtg >= '".$from."' and meter_dtg <= '".$to."';";

this is how I call this page

$strDataURL = "glucose.php?pid=$pid&from='$from'&to='$to'";
#echo "Patient Details";// for testing
//Create the chart - Pie 3D Ch$strDataURL = "glucose.php?pid=$pid&from='$from'&to='$to'";art with dataURL as strDataURL
echo renderChart("FCF_Line.swf", $strDataURL, "", "FactorySum", 650, 450);
Just for testing I called same page with href and I could see the values are passed to glucose.php properly.
Could you please let me know what is going wrong.
Thanks,
Bilal

laserlight

Is the $strDataURL variable just for demonstration purposes? If you actually want to access $_GET['pid'] etc, then you should not be using $strDataURL. If you actually want to pass a query string-like string to renderChart() and then extract the name/value pairs, then you should be using [man]parse_str/man.

By the way, remember to escape the data used in the SQL statement appropriately.

bam_usic

I did a test and checked that parametes are passed ok to other page and recieved .AS I could display them and I was also able to display values from database.
But the trouble is when I use it for displaying the chart.It fails with no Data to display message.
But if I hardcode the values which I pass it builds the chart.

Weedpacket

$strDataURL = "glucose.php?pid=$pid&from='$from'&to='$to'";

The single quotes around $from and $to shouldn't be there; they'll mean that the values will have extra quotes when you search for them - you'll be looking for [font=monospace]meter_dtg>=''2006-12-04''[/font] instead of [font=monospace]meter_dtg>='2006-12-04'[/font], and won't find it.

In short, values in URL query strings aren't quoted. (They're [man]urlencode[/man]d instead).

bam_usic

$strDataURL = "glucose.php?pid=$pid&from=$from&to=$to";