Variables in a MySQL command

hendy

Hi All,

Im using php to make a page where a user enters a customer number and a code to search a database.

it calls another page to display the results.

On the second page i have the following code:

<?php

mysql_connect("localhost", "root", "2233home") or die(mysql_error());
mysql_select_db("customers")
or die(mysql_error());
echo "<b>Connected<br>";

mysql_query("select*from $_REQUEST["File1"] where Code = $_REQUEST["Code"]")
or die(mysql_error());
echo "File used $_REQUEST["File1"]<br><br>";
echo "File $_REQUEST["File1"] was inserted.";
?>

But it dosent return anything at all...
Any ideas?

Thanks

laserlight

You are using variable tables? What is your database schema like?

hendy

what do u mean by schema?

Here is a description of the table if thats what you mean:

laserlight

Okay, so you have a table named db10001

Why cant you do a:

mysql_query("SELECT * FROM db10001 where Code='{$_REQUEST['Code']}'");

hendy

sorry i think your missing what i want to tdo, i have over 60 tables, so the user can select which table and which code to use, your statement will only allow the user to enter the code as variable, i need to be able to enter 2 variables.

Thanks

laserlight

sorry i think your missing what i want to tdo, i have over 60 tables, so the user can select which table and which code to use, your statement will only allow the user to enter the code as variable, i need to be able to enter 2 variables.

Why do you have over 60 tables with similiar schema? Combine them into a single table, and vary by some other field.

hendy

if i vary the field names it means creating 60 duplicate webpages, id rather create 60 tables than 60 webpages!!!!

laserlight

if i vary the field names it means creating 60 duplicate webpages, id rather create 60 tables than 60 webpages!

Hardly. It just means that your database design is incorrect.

Let's start with: what are you trying to model with your database?

laserlight

By the way, if you really do want to keep to your original design, you are probably looking to write:

mysql_query("SELECT * FROM {$_REQUEST["File1"]} WHERE Code='{$_REQUEST["Code"]}'")
	OR die(mysql_error());

The problem here is that you have to check $_REQUEST["File1"], and you have to be very careful to ensure that it is a valid table. This may mean having to create a master table to track the various tables that can vary.

hendy

tried that but again no joy!!! its for a small business so i dont need to worry about having to ensure that its a valid table, i was think of having a drop down list of table names so that would ensure that a vaild table is always used.

I can can get the page to show the details if i manually insert the information into the mysql statement, but when i try to use variables it displays a blank page. very strange.

Thanks for your help.

laserlight

tried that but again no joy!!! its for a small business so i dont need to worry about having to ensure that its a valid table, i was think of having a drop down list of table names so that would ensure that a vaild table is always used.

It becomes a security vulnerability if you fail to properly validate.

I can can get the page to show the details if i manually insert the information into the mysql statement, but when i try to use variables it displays a blank page.

Standard debugging procedure: print the variables to see what values they contain.