0

What I've looked at already

I'm seriously new to PHP and I was hoping you guys could point me in the right direction. I've read the following threads and adapted its answers, but I'm obviously not doing something correctly:

Creating table with variable name php mysql

Use a variable as table name when creating a table in mysql

Create mysql table with php variable not working

In particular, its this block of code I've been trying to adapt to my own needs as it was one of the few examples that used heredocs, which is what we've been taught to use:

$create = <<<SQL
CREATE TABLE `$tableusername` (
    `ID` INT NOT NULL AUTO_INCREMENT PRIMARY KEY,
    `please` VARCHAR(50) NOT NULL,
    `make` VARCHAR(50) NOT NULL,
    `this` VARCHAR(50) NOT NULL,
    `work` VARCHAR(50) NOT NULL
)

My situation

I want my register.php to create a new table using the username the user has chosen. (Register.php isn't accessible if a user is already logged in, so duplicates of a table will never be possible.) This table will later be used to graph the data contained within the table, which is why I've not set a PK, as the table will never be joined or have its contents shared with another table. (If it turns out this is what's not making it work, I'll add in an auto-incrementing ID).

The problem

The table doesn't get created.

My register.php EDIT: In accordance with a suggestion, I've added to the code

I got an error message pertaining to the syntax of encapsulating each column name within quotes, so I removed those to then get the following error message:

Could not query database1064 : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 11

<?php
include('template.php');
if (isset($_POST['username']) and isset($_POST['password'])) {
    $name = $mysqli->real_escape_string($_POST['username']);
    $pwd = $mysqli->real_escape_string($_POST['password']);
    $mail = $mysqli->real_escape_string($_POST['email']);
    $first = $mysqli->real_escape_string($_POST['fname']);
    $last = $mysqli->real_escape_string($_POST['lname']);
    $query = <<<END
    INSERT INTO p_users(username,password,email,fname,lname)
        VALUES('{$name}','{$pwd}','
            {$mail}','{$first}','{$last}')
END;
    $table = <<<END
        CREATE TABLE `$name` (
            steps_per_day int,
            energy_expenditure int,
            distance_walked_per_day int,
            bed_time int,
            waking_time int,
            hours_slept int,
            num_daytime_naps int,
            outdoor_temp int,
            indoor_temp int
        )
END;
    if ($mysqli->query($table) !== TRUE) {
            die("Could not query database" . $mysqli->errno . " : " . $mysqli->error);
                header('Location:index.php');
        }
    if ($mysqli->query($query) !== TRUE) {
        die("Could not query database" . $mysqli->errno . " : " . $mysqli->error);
            header('Location:index.php');
    }

}

$content = <<<END
<form method="post" action="register.php">
<input type="text" name="username" placeholder="username"><br>
<input type="password" name="password" placeholder="password"><br>
<input type="text" name="email" placeholder="email"><br>
<input type="text" name="fname" placeholder="first name"><br>
<input type="text" name="lname" placeholder="last name"><br>
<input type="submit" value="Register">
<input type="Reset" value="reset">
</form>
END;
echo $navigation;
echo $content;
?>
viKK
  • 17
  • 1
  • 7
  • 2
    you'll get a sql-injection with dirty tablename. `real_escape_string` works only for data. https://dev.mysql.com/doc/refman/5.7/en/identifiers.html – Deadooshka Apr 29 '18 at 15:48
  • @Deadooshka but everything I've used real_escape_string on is data, isn't it? – viKK Apr 29 '18 at 16:01
  • 1
    `indoor_temp int,`, that last comma shouldn't be there -- edit: Oh, and what Deadooshka is saying, he really makes a good point! – Peter van der Wal Apr 29 '18 at 16:11
  • @PetervanderWal THANK YOU SO MUCH! <3 I'm new to this, is there any way of upvoting / selecting a comment as the best answer? edit: could you expand on what he's saying? As far as I can see, i'm using real_escape_string on data that the user inputs, is that incorrect? – viKK Apr 29 '18 at 16:16

1 Answers1

-1

indoor_temp int, - that last comma shouldn't be there, since it is the last column thus resulting in ...outdoor_tempint,indoor_tempint, )

Sidenotes:

And you should REALLY have a look at Deadooshka's comment. real_escape_string doesn't prevent you from SQL injection when using the value as a tablename!!!

Probably a single table with all user-readings and an an extra column username (or userid) is a better and safer database-design.

Peter van der Wal
  • 10,558
  • 2
  • 20
  • 29
  • Ok! I'll research into the SQL injection vulnerability I've opened myself up to by doing this and I'll evaluate whether I can design it any other way :). Thank you and @Deadooshka both! EDIT: How do i select your answer as the best answer? – viKK Apr 29 '18 at 16:26