How to use a string variable as a table destination in a INSERT INTO PHP

Question

I have this code

<?php
$servername = "localhost";
$username = "username";
$password = "pass";

// Create connection
$conn = new mysqli($servername, $username, $password);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
} 

//Take the data from the request
$json = file_get_contents('php://input');
$data = json_decode($json, true);

$tableto = $data['tabledestination'];
$Question = $data['question'];
$answerone = $data['answerone'];
$answertwo = $data['answertwo'];
$answerthree = $data['answerthree'];
$Feedback = $data['feedback'];
$Correctanswer = $data['Correctanswer'];
$reparcial = $data['partial'];


//Insert the data into the database


$sql = "INSERT INTO mydatabase."$tableto" (Question, Answer_1, Answer_2, Answer_3, Correct_Answer, Parcial, Feedback)
VALUES ('" . $Question . "', '" . $answerone . "', '" . $answertwo . "', '" . $answerthree . "', '" . $Correctanswer . "', '" . $reparcial . "', '" . $Feedback . "')";

if ($conn->query($sql) === TRUE) {
    echo '{ "result": "success" }';
} else {
    echo '{ "result": "error" }';
}


//Close the connection
$conn->close();

?>

I pass the information through a URLRequest with HTTPMethod "POST" I want to send though the dictionary that I posted the table destination of my database so I can assign the destination of the table depending on the string I pass

You for got to add dots around your $tableto variable, in the $sql string. — Rainner, Jan 22 '16 at 00:03
change this `mydatabase."$tableto"` to `mydatabase.".$tableto."` — Akam, Jan 22 '16 at 00:04
First i see no $conn is created. Also even if this script runs it's vulnerable to sql injection. use parameterized queries, prepared statements instead direct insert query. — Uğur Taşdildiren, Jan 22 '16 at 00:06
I change it, but it say error, It didn't query, I remove the account information from this code — Samuel Pacheco Cantu, Jan 22 '16 at 00:07
It actually works after you put the data to create the string, I new in programming so I don't know a lot about php or mysql — Samuel Pacheco Cantu, Jan 22 '16 at 00:09
here is an explanation what i was talking about. learn right way to do if you are new. http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php — Uğur Taşdildiren, Jan 22 '16 at 00:12
**WARNING**: When using `mysqli` you should be using parameterized queries and [`bind_param`](http://php.net/manual/en/mysqli-stmt.bind-param.php) to add user data to your query. **DO NOT** use string interpolation or concatenation to accomplish this because you will create severe [SQL injection bugs](http://bobby-tables.com/). **NEVER** put `$_POST` data directly into a query. — tadman, Jan 22 '16 at 00:13
Thanks for the recommendation, I will check the information about the bind_param — Samuel Pacheco Cantu, Jan 22 '16 at 00:30

score 0 · Answer 1 · answered Jan 22 '16 at 01:13

the following

$sql = "INSERT INTO mydatabase."$tableto" (Question, Answer_1, Answer_2, Answer_3, Correct_Answer, Parcial, Feedback)
VALUES ('" . $Question . "', '" . $answerone . "', '" . $answertwo . "', '" . $answerthree . "', '" . $Correctanswer . "', '" . $reparcial . "', '" . $Feedback . "')";

Has a problem because of the use of "

When declaring $sql you're using the concatenation of a string and you missed the . in your concatenation.

try changing to:

$sql = "INSERT INTO mydatabase." . $tableto . " (Question, Answer_1, Answer_2, Answer_3, Correct_Answer, Parcial, Feedback)
    VALUES ('" . $Question . "', '" . $answerone . "', '" . $answertwo . "', '" . $answerthree . "', '" . $Correctanswer . "', '" . $reparcial . "', '" . $Feedback . "')";

How to use a string variable as a table destination in a INSERT INTO PHP

1 Answers1