mysql search form question

I have a search f开发者_运维问答orm that has these elements:

<style type="text/css">
body,td,th {
    color: #FFF;
}
body {
    background-color: #060;
}
</style>
<div align="center">
  <p>&nbsp;</p>
  <p>&nbsp;</p>
  <p>&nbsp;</p>
  <p>&nbsp;</p>
</div>
<?php
mysql_connect ("localhost", "xxxx","xxxxxxx")  or die (mysql_error());
mysql_select_db ("xxxxxxx");

$term = $_POST['term'];

$sql = mysql_query("select * from Patients where ID like '%$term%'");


while ($row = mysql_fetch_array($sql)){
    echo 'ID: '.$row['ID'];
    echo '<br/> First Name: '.$row['firstname'];
    echo '<br/> Last Name: '.$row['lastname'];
    echo '<br/> Valid Until: '.$row['validto'];
    echo '<br/><br/>';
    }

It works great as is but I need it to get the date from the server and compare it to the validto field in the database, if the server date is equal to or prior to the validto date it should echo "Status: Valid". Otherwise it should echo "Status: Invalid".

This area need attention:

$term = $_POST['term'];

should be

$term = mysql_real_escape_string($_POST['term']);

then you can do your comparison:

$today = date("Y-m-d"); // mysql default date format

$sql = "SELECT  * FROM Patients 
       WHERE ID LIKE '%$term%'
       AND validto <= '$today'";

why not add

<?php

$curDate = date('Y-m-d');
$validTill = strtotime($row['validto']);
... and can we compare it...

?>

You can check the date easily enough with just mysql.

$sql = mysql_query("select Patients.*, IF(validto > NOW(), 'Valid', 'Invalid') AS status from Patients where ID like '%$term%'");

while ($row = mysql_fetch_array($sql)){
    echo 'ID: '.$row['ID'];
    echo '<br/> First Name: '.$row['firstname'];
    echo '<br/> Last Name: '.$row['lastname'];
    echo '<br/> Valid Until: '.$row['validto'];
    echo '<br/> Status: ' . $row['status'];
    echo '<br/><br/>';
    }

If validto is a datetime, you can convert it to a timestamp (int) with strtotime:

$validto = strtotime($row['validto']);
$current_time = time();

if($current_time > $validto) {
   echo 'invalid';
} else {
   echo 'valid';
}