Can you give me an idea of what this line of code is saying?

Can you tell me about this line of code:

$this_day_video_earn = $db->rawQuery("SELECT SUM(amount - admin_com) AS sum FROM ".T_VIDEOS_TRSNS." c WHERE `time` >= ".$day_start." AND `time` <= ".$day_end." AND user_id = ".$pt->user->id);

PHP:

 

Looks like it's getting a sites daily earnings from either sales and/or viewings of videos. As it stands it's vulnerable to SQL Injection attacks as they're plugging raw data into a query

 

Thanks for your reply.

I am trying to change that script file to get the site's daily earnings, instead, to come from the amount in the 'u_paid_videos' (db table) > 'earned_amount' (column) which reflects the earned amount that the uploader earns upon each video sales transaction. I tried this without success:

$this_day_video_earn = $db->rawQuery("SELECT (earned_amount) FROM ".T_U_PAID_VIDEOS." c WHERE `time` >= ".$day_start." AND `time` <= ".$day_end." AND user_id_uploaded = ".$pt->user->id);
//$this_day_video_earn = $db->rawQuery("SELECT SUM(amount - admin_com) AS sum FROM ".T_VIDEOS_TRSNS." c WHERE `time` >= ".$day_start." AND `time` <= ".$day_end." AND user_id = ".$pt->user->id);

PHP:

By 'without success' I mean that upon selecting the 'transaction' html page, it just hangs, it doesn't redirect to it. But, if I remove my modification attempt, it redirects successfully.

Any ideas on helping me with what I'm trying to accomplish will be appreciated.

 

Translation: Execute me to slow your database down and get your web site hacked.

 

Try this:

$this_day_video_earn = $db->rawQuery("SELECT (earned_amount) as sum FROM ".T_U_PAID_VIDEOS." c WHERE `time` >= ".$day_start." AND `time` <= ".$day_end." AND user_id_uploaded = ".$pt->user->id);
//$this_day_video_earn = $db->rawQuery("SELECT SUM(amount - admin_com) AS sum FROM ".T_VIDEOS_TRSNS." c WHERE `time` >= ".$day_start." AND `time` <= ".$day_end." AND user_id = ".$pt->user->id);

 

That's still vulnerable to SQL injection attacks

 

Yes vulnerable, but he just wanted that line changed so his script could get the result of the query.

Also, I think the script is sending query parameters which the user cannot change, probably checked previously for validity.