use a table name that is equal or similar to variable captured in form to do query

Question

Ok, so I have a variable $city and it passes a value from the submit form as "New York" when this happens, I want to do a query in a table name that matches the $city value. in this case New York.

The table name would be New_York

Form page For example: What city do you need?: $city Submit

Results page

$city=$_POST['city'];
$sql = $db->query(Select * from $city);

(where $city should be the name of the table)

How do I accomplish this?

Keep in mind my city list has names that use spaces whereas table names cant.

This kind of problem is symptomatic of appallingly bad design — Strawberry, Dec 11 '16 at 09:23

Adam Hull · Accepted Answer · 2016-12-11T09:34:54.233

0

You could try to replace spaces with underscores using str_replace

$city = str_replace(' ', '_',$_POST['city']);
$sql = $db->query("SELECT * FROM {$city}");

***please note this code is prone to sql attacks*

edited Dec 11 '16 at 09:34

answered Dec 11 '16 at 09:26

Adam Hull

214
1
8

would you recommend I use a new variable name as I do "print" the city name in a paragraph in the page? – Natan Coats Dec 11 '16 at 09:28
Yes otherwise you will be having _ in your paragraph – Adam Hull Dec 11 '16 at 09:30
Thank you and to make reference to this new $citytbl in the query I just use the variable name directly or do I have to use special characters around it? – Natan Coats Dec 11 '16 at 09:32
what would be the pdo version? – Natan Coats Dec 11 '16 at 09:37
http://stackoverflow.com/questions/15182910/php-pdo-bind-table-name Please read – Adam Hull Dec 11 '16 at 09:43

use a table name that is equal or similar to variable captured in form to do query

1 Answers1