creating a table using $_POST parameters

Question

I'm trying to create a table where the table name is a parameter. Is it possible? Like this:

$result = pg_query("CREATE TABLE '$_POST[nome_arquivo_software]' (
    id serial CONSTRAINT pk_'$_POST[nome_arquivo_software]' PRIMARY KEY,
    nome  varchar (80),
    email varchar (80),
    estado varchar (80),
    acessos numeric
)");

This is wide open to SQL injection. You shouldn't pass user-input variables directly to the script, as you're risking your entire database. — Ohgodwhy, Jan 06 '16 at 03:34
@Ohgodwhy in this case I'm the only user... so I did this form just to make things faster... — Léo Eduardo Silva, Jan 06 '16 at 03:37
@LéoEduardoSilva like Ohgodwhy said, that is open to SQL injection. So to prevent that, you should validate the input first to make sure it is safe to use. — momouu, Jan 06 '16 at 03:50
@Fred-ii- of course I did! hahaha the problem is that it isn't working — Léo Eduardo Silva, Jan 06 '16 at 03:50
@monace19 got it. In case of text to the name of table, why isn't it working? What am I doing wrong? — Léo Eduardo Silva, Jan 06 '16 at 03:54
@monace19 it shows: ERROR: syntax error at or near "'test'" LINE 1: CREATE TABLE 'test' where test is the $_POST[nome_arquivo_software], but if I try to create the table without using parameters and put the word test in the SQL code, it works. The problem is in $_POST[nome_arquivo_software]. — Léo Eduardo Silva, Jan 06 '16 at 04:01
You'll need to tell us why then. Check for errors http://php.net/manual/en/function.error-reporting.php and http://php.net/manual/en/function.pg-result-error.php — Funk Forty Niner, Jan 06 '16 at 04:01
it's the way you're using your POST array and its quoting method, that's why you're getting that error. Use ticks `\`` instead of quotes or just remove them altogether. But I'd use a different method altogether. — Funk Forty Niner, Jan 06 '16 at 04:02
@VolkerK definitely a quotes issue, for sure ;-) I'm not familiar with postgresql. — Funk Forty Niner, Jan 06 '16 at 04:07
@Fred-ii- and VolkerK you were right! All I did was remove double quotes and it worked. I'm always having trouble with this things, because it seens that for every each case you have to use different methods of quotings. Thanks you all! — Léo Eduardo Silva, Jan 06 '16 at 04:12
@LéoEduardoSilva you're welcome. You've been given an answer below where he escaped it with double quotes. — Funk Forty Niner, Jan 06 '16 at 04:13

score 3 · Accepted Answer · answered Jan 06 '16 at 04:10

3

The table name is not a string literal but an identifier -> change single-quote to double-quotes -> quoted identifier.

The name of the id field is not pk_+string literal but the whole thing is an identifier -> "pk_...."

// <--- intensive checks on $_POST[nome_arquivo_software] and $_POST[nome_arquivo_software] here
$result = pg_query("
    CREATE TABLE \"$_POST[nome_arquivo_software]\" (
    id serial CONSTRAINT \"pk_$_POST[nome_arquivo_software]\" PRIMARY KEY,
    nome  varchar (80),
    email varchar (80),
    estado varchar (80),
    acessos numeric
    )
");

answered Jan 06 '16 at 04:10

VolkerK

95,432
20
163
226

problem solved! Your code worked too! But I think removing quotes of parameters is easier. Thanks for all tips. Stackoverflow always helps me :) – Léo Eduardo Silva Jan 06 '16 at 04:13
if you want uppercase letters or other unusual symbols in the name of the table then the quotes are required. – Jasen Jan 06 '16 at 04:31

creating a table using $_POST parameters

1 Answers1