use php variable in name of mysql create table

Question

Hey guys i want to use an php variable as a part of a name of a mysql table which i create with a query. I used two types of quotes like a example i saw on the internet. It should create an individual table name. $cn is not an array it is an single value. I have php error reporting enabled and it doesn't show any errors. Here is what i tried:

$sql2 = "CREATE TABLE lm_Warenkorb_`".$cn."`
     (
     Index TEXT,
     )";

Why isn't this working? Is this possible or not? Hope it is clear what i want to do.

Just a shot in the dark here... but does your database user have the create privilege? — Lix
– Lix, Commented Nov 29, 2012 at 11:43

triclosan · Accepted Answer · 2012-11-29 11:22:38Z

3

$sql2 = "CREATE TABLE `lm_Warenkorb_".$cn."`
     (
     Index TEXT,
     )";

answered Nov 29, 2012 at 11:22

triclosan

5,7846 gold badges30 silver badges53 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

SDC Over a year ago

If $cn is from user input, you should also make sure that $cn doesn't contain any backtick or other illegal characters, otherwise a SQL injection attack may be possible.

Alesfatalis Over a year ago

doesn't work for me it runs through but no table is appearing

triclosan Over a year ago

@SDC answer was given according to Pgr456 code, assuming all check has already done

triclosan Over a year ago

@Pgr456 did you select DB first?

Alesfatalis Over a year ago

triclosan can't you imagina what could be also wrong i selected database before

|

Lix · Accepted Answer · 2012-11-29 11:22:37Z

2

I think you'll need to wrap the entire table name in backticks...

$sql2 = "CREATE TABLE `lm_Warenkorb_{$cn}`
     (
     Index TEXT,
     )";

Also you can use curly brackets to insert variables into strings encapsulated with double quotes.

answered Nov 29, 2012 at 11:22

Lix

48.2k12 gold badges107 silver badges134 bronze badges

3 Comments

SDC Over a year ago

If $cn is from user input, you should also make sure that $cn doesn't contain any backtick or other illegal characters, otherwise a SQL injection attack may be possible.

Lix Over a year ago

@SDC - most certainly. In any case, one should take care to sanitize any user submitted data that is destined to be saved/used at a later stage.

SDC Over a year ago

yep. I guess my point is that it needs to be sanitised differently from most other strings that are inserted into a SQL statement. The standard sanitation methods aren't useful when you have dynamic tablenames and fieldnames, but doing the sanitation is just as important.

Denis Ermolin · Accepted Answer · 2012-11-29 11:23:08Z

2

Your code will produce string:

CREATE TABLE lm_Warenkorb_`some_string`(Index TEXT,)

I think it must be 2 variants:

CREATE TABLE `lm_Warenkorb_`.`some_string`(Index TEXT,)

Or

CREATE TABLE `lm_Warenkorb_some_string`(Index TEXT,)

answered Nov 29, 2012 at 11:23

Denis Ermolin

5,5746 gold badges29 silver badges45 bronze badges

Collectives™ on Stack Overflow

use php variable in name of mysql create table

3 Answers 3

7 Comments

3 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

7 Comments

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related