variable in SQL query - PHP MYSQL

Question

I have 2 variable holding dates. I am getting a syntax error in the SQL statement when I use the variables.

$from_date = '2013-02-13';
$to_date = '2013-02-20';
$query="SELECT * FROM mytable where datex >= ".$fromdate." AND datex <= ".$todate.";

Help me identify and correct this syntax error?

Thanks.

Answer 1

You need to quote your variables:

$query="SELECT * FROM mytable where datex >= '".$fromdate."' AND datex <= '".$todate." . "'";

But it would be better to use a prepared statement with bound variables. Then your query could look like (PDO):

$query="SELECT * FROM mytable where datex >= :fromdate AND datex <= :todate";

Answer 2

im doing something similar would this be the correct way to do it ?

  <?php
  include 'connect.php';

  $id1 = $_POST['PatientID']; //Text box the user searches in
  $result = mysqli_query($con,"SELECT * FROM PatientRecords WHERE PatientID= '".$id1."'");
  while($row = mysqli_fetch_array($result))