PHP SQL create table with variable name

nate2099 · June 4th, 2007, 05:19 AM

Hi,

I have two questions, firstly can I create a table with the name of a variable using php?? This is what I'm trying:

Code:


			
$query="CREATE TABLE $quote_num 
(
ID int(7) NOT NULL auto_increment,
itemid varchar(10) NOT NULL,
itemdesc varchar(50) NOT NULL,
)";

EDIT----------------

Code:


			
mysql_query("CREATE TABLE '".$quote_num."' 
   (
   ID int(7) NOT NULL auto_increment,
   itemid varchar(10) NOT NULL,
   itemdesc varchar(50) NOT NULL,
   )");

This doesn't work either... and neither of them give an error..

/EDIT------------------

Also, are there any security issues in the following scenario:

A company produces quote and saves to database. Sends an email to client with a link and query string containing quote number to client. Client clicks link and webpage retrieves quote from database. Client checks "accept quote" and submits.

Thanks,

Nathan.

Blake121 · June 4th, 2007, 06:12 AM

This should work... You have to use real escape string to make the data safe before using it with a database.

The mysql_error() part will give you a detailed error if something goes wrong. (Remove the mysql_error() part from a live website.);

Code:

$quote_num = mysql_real_escape_string($quote_num);
 
$sql="CREATE TABLE $quote_num
(
ID int(7) NOT NULL auto_increment,
itemid varchar(10) NOT NULL,
itemdesc varchar(50) NOT NULL,
)";
 
$query = mysql_query($sql) or die (mysql_error());

masonbarge · June 4th, 2007, 08:51 AM

I can't see a syntax mistake in your original version but AFAIK you have to set a primary key on your auto-increment column. This is a mysql problem.

nate2099 · June 12th, 2007, 08:25 AM

Hmm, thanks for your help. I couldn't get this to work so I had to do it another way, thanks anyway.