PHP and MySQLi prepared statements

Hi,

I have written a PHP script that will be used to find and order news item by the month they were added. The results will first be grouped by year and then by month. I want to use mysqli with prepared statements to write the query.

This is what I've written so far:

echo "<div class = 'latest_nav'>";
                       
    echo "<h1>Past News</h1>";
       
    for ($y = 2013; $y > 2008; $y--)
    {
        echo "<div class = 'accordion' id = 'accordion'>";
 
              echo "<div class = 'accordion-group'>";
 
                  echo "<div class = 'accordion-heading-news'>";
 
                    echo "<a class = 'accordion-toggle' data-toggle = 'collapse' data-parent = '#accordion2' href = '#$y'><img src = 'img/content/news_button_icon.png' class = 'button_icon'>$y</a>";
 
                  echo "</div>";
 
                  echo "<div id = '$y' class = 'accordion-body collapse'>";
 
                    echo "<div class = 'accordion-inner'>";
                                           
                        for ($m = 12; $m > 0; $m--)
                        {
                            if (strlen($m) == 1)
                            {
                                $m = 0 . $m;
                            }
   
                            if($get_past_news = $mysqli->prepare("SELECT DATE_FORMAT(date_added, '%d %M %Y') AS full_date, DATE_FORMAT(date_added, '%d') AS day, DATE_FORMAT(date_added, '%m') AS month, DATE_FORMAT(date_added, '%M') AS month_link, DATE_FORMAT(date_added, '%Y') AS year FROM news WHERE date_added LIKE ? AND news_type = 'news' AND display_on_site = 'Y'")) {
       
                                // Bind a variable to the parameter as a string.
                                $get_past_news->bind_param("s", $y . "-" . $m . "-%%");
                                  // Execute the statement.
                                $get_past_news->execute();
 
                                /* store result */
                                $get_past_news->store_result();
   
                                if($get_past_news->num_rows > 0)
                                {
                                      // Get the variables from the query.
                                    $get_past_news->bind_result($full_date, $day, $month, $month_link, $year);
                                    // Fetch the data.
                                    $get_past_news->fetch();
                                   
                                    echo "<p><a href=\"news.php?month=$month&year=$year\">$month_link</a></p>";
                                }
                               
                                else
                                {
                                    if($m == 1){echo "<p>January</p>";}
                                    elseif($m == 2){echo "<p>February</p>";}
                                    elseif($m == 3){echo "<p>March</p>";}
                                    elseif($m == 4){echo "<p>April</p>";}
                                    elseif($m == 5){echo "<p>May</p>";}
                                    elseif($m == 6){echo "<p>June</p>";}
                                    elseif($m == 7){echo "<p>July</p>";}
                                    elseif($m == 8){echo "<p>August</p>";}
                                    elseif($m == 9){echo "<p>September</p>";}
                                    elseif($m == 10){echo "<p>October</p>";}
                                    elseif($m == 11){echo "<p>November</p>";}
                                    elseif($m == 12){echo "<p>December</p>";}
                                }
                            }   
                        }
           
                    echo "</div>";
       
                echo "</div>";
   
            echo "</div>";
   
        echo "</div>";       
   
    }
   
echo "</div>";

Code (markup):

This issue I'm experiencing surrounds the part of the query that reads WHERE date_added LIKE ? - how do I include the elements that make up date_added field? The following doesn't seem to work:

// Bind a variable to the parameter as a string.
$get_past_news->bind_param("s", $y . "-" . $m . "-%%");

Any ideas?

Thanks in advance!

 

Just do the concactination beforehand. Ie like this:

$querydate = $y.'-'.$m.'-%%';

$get_past_news->bind_param('s',$querydate);

That should work just fine.