Prepared sql request INSERT INTO a variable table

Question

I'm trying to execute a prepared sql request wich should insert values into a variable table

This code will be more explicite than me :

$req = $db->prepare("INSERT INTO ? 
                    (    `id`, 
                         `parent_id`, 
                         `position`, 
                         `left`, 
                         `right`, 
                         `level`, 
                         `title`, 
                         `type`, 
                         `content`   ) 
                    VALUES (NULL, 
                         '2', 
                         'last', 
                         '3', 
                         '10', 
                         '2', 
                         ?, 
                         'default', ?);");

$req->execute(array($_SESSION["user_id"], $result["title"], $result["content"]));

All variables are set, I checked that with some echo. Isn't it possible to "INSERT INTO" a variable ?

(Each user has its own table named by its unique id, that's why I can't directly write the table name in the query)

No, it isn't, because you shouldn't have a table structure where each user gets its own table. — Waleed Khan
– Waleed Khan, Commented Aug 17, 2012 at 14:15
Okay, so if it is impossible to do it this way, isn't there another solution ? (i can't modify the database structure, it has be setup like this for the needs of our application) — fwoelffel
– fwoelffel, Commented Aug 17, 2012 at 14:18

andrewsi · Accepted Answer · 2012-08-17 14:18:10Z

2

You can't use a named parameter for a table name; if you want to do that, you'll have to include the name in your SQL directly:

INSERT INTO $tablename (....

However - that's still open to SQL injection attacks.

If you want to store data like that, I'd put everything into a single table, and just add an extra field as an additional key.

answered Aug 17, 2012 at 14:18

andrewsi

10.7k132 gold badges37 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

fwoelffel Over a year ago

So INSERT INTO $_SESSION["user_id"]... will be fine ?

burmat Over a year ago

What he's saying is that will work, but it is not best practices to follow through with that method.

andrewsi Over a year ago

Eschard1991 - as @burmat said, it does work, but be sure to sanitize the input you're getting. If it's a user ID number, you can for example strip out everything that isn't a digit.

Peter Kiss Over a year ago

Put the possible table names in one array and before executing the query check that the $_SESSION["user_id"] or anything else is in that array. If exists then execute the query else throw an exception or something. (Andrewsi is right about the single table approach.)

xdazz · Accepted Answer · 2012-08-17 14:17:55Z

0

No, you can't do this, you need to do like below.

$table = $_SESSION["user_id"];
$req = $db->prepare("INSERT INTO $table (`id`, `parent_id`, `position`, `left`, `right`, `level`, `title`, `type`, `content`) VALUES (NULL, '2', 'last', '3', '10', '2', ?, 'default', ?);");
$req->execute(array($result["title"], $result["content"]));

answered Aug 17, 2012 at 14:17

xdazz

161k38 gold badges255 silver badges278 bronze badges

Collectives™ on Stack Overflow

Prepared sql request INSERT INTO a variable table

2 Answers 2

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related