While using the PDO statements you could follow up the procedure where PDO is strong enough to avoid SQL Injections. But you have not followed up the process in your code. Usage of bind parameters is advised.
Note: Your code will work well except the fetch statement. You have to fetchAll(); so that it is able to capture all the data from the resultant query and you can print it.
If this is the case you have to use fetchAll(); for retrieving multiple lines of output from the DB or else for retrieving the singe line of output your code will look fine.
Solution One:
You can use bind parameters in the function so that it avoids SQL Injections.
functions.php
function getdate($id)
{
$select = $conn->prepare("SELECT `date` FROM `dates` WHERE user_id= :id ");
$select->bindValue(':id', $id, PDO::PARAM_INT);
$select->execute();
$result = $select->fetchAll(PDO::FETCH_ASSOC);
return $result;
}
Other File you can get the function call like this.
$result = getdate(3);
And you have to print_r() the $result. So that it will be resulting in the array() structure.
Some more clear explanations regarding the fetch statements in PDO.
PDO has some extremely handy methods to return the query result in different formats:
fetch() - a general purpose fetch method similar to mysql_fetch_array().
fetchAll() - to get all the rows without while loop.
fetchColumn() - to get single scalar value without getting array first.
Example:
$stmt = $pdo->prepare("SELECT id,name FROM songs WHERE dt=curdate()");
$stmt->execute();
$data = $stmt->fetchAll();
Now we have all the songs in the $data array and we can desing the page as we want.
<table>
<?php foreach ($data as $row): ?>
<tr>
<td>
<a href="songs.php?<?=$row['id']?>">
<?=htmlspecialchars($row['name'])?>
</a>
</td>
</tr>
<?php endforeach ?>
</table>
print_r($array);if you want to see its contents