using variables in sql statement

[jjfletch]

Ok, I'm trying to use php to create a table in mysql. The table name is a based on user input. I don't want certain characters (like the @ and .) to appear in the table name.

So, first, I do this:

$sqltable = ereg_replace("[^a-z,A-Z,0-9,_]","",$userinput);

Then, I try this:

$query = "CREATE TABLE". $sqltable ."(id INT(8) AUTO_INCREMENT NOT NULL PRIMARY KEY,
                                fn VARCHAR(255) NOT NULL,
                                ed TIMESTAMP,
                                et LONGTEXT)";

But, this isn't working for me. The table doesn't get created. Can someone help me out here?

[toxic_brain]

$query = "CREATE TABLE". $sqltable ."(id INT(8)

result:

CREATE TABLEtable_name(...)

put a space

"CREATE TABLE ". $sqltable

[jjfletch]

Ohhhhhhhhh. 😃 Thanks!