PHP SQL create table with variable name

[nate2099]

Hi,

I have two questions, firstly can I create a table with the name of a variable using php?? This is what I'm trying:

PHP: Select all

$query="CREATE TABLE $quote_num 
(
ID int(7) NOT NULL auto_increment,
itemid varchar(10) NOT NULL,
itemdesc varchar(50) NOT NULL,
)"; 

EDIT----------------

PHP: Select all

mysql_query("CREATE TABLE '".$quote_num."' 
   (
   ID int(7) NOT NULL auto_increment,
   itemid varchar(10) NOT NULL,
   itemdesc varchar(50) NOT NULL,
   )"); 

This doesn't work either... and neither of them give an error..

/EDIT------------------

Also, are there any security issues in the following scenario:

A company produces quote and saves to database. Sends an email to client with a link and query string containing quote number to client. Client clicks link and webpage retrieves quote from database. Client checks "accept quote" and submits.

Thanks,

Nathan.

[Blake121]

This should work... You have to use real escape string to make the data safe before using it with a database.

The mysql_error() part will give you a detailed error if something goes wrong. (Remove the mysql_error() part from a live website.);

Code: Select all

$quote_num = mysql_real_escape_string($quote_num);
 
$sql="CREATE TABLE $quote_num
(
ID int(7) NOT NULL auto_increment,
itemid varchar(10) NOT NULL,
itemdesc varchar(50) NOT NULL,
)";
 
$query = mysql_query($sql) or die (mysql_error());

[masonbarge]

I can't see a syntax mistake in your original version but AFAIK you have to set a primary key on your auto-increment column. This is a mysql problem.

[nate2099]

Hmm, thanks for your help. I couldn't get this to work so I had to do it another way, thanks anyway.