Creating a DB from form Input

malatang

Hi,
I am just learing PHP and I am trying to create a Mysql database from the input of a form.

Here is the script I have written.

<?php 
$link=@mysql_connect("localhost","root","")
or die("sorry - could not connect to MYSQL" );

if (isset($_POST['submit'])) 
{ 
  $mysql = "CREATE DATABASE IF NOT EXISTS '$_POST[db]'";
} 
else 
  { 
  $rs = @mysql_list_dbs( $link ); 
  for( $row = 0; $row  < mysql_num_rows( $rs ); $row++ ) 
  { $list .= mysql_tablename( $rs, $row ) . " | "; }
?>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
        <title></title>
    </head>
</body>
<form action = "<?php echo( $_SERVER['PHP_SELF'] ); ?>"
method="post">Current databases: <?php echo( $list ); ?>
<hr>Name: <input type = "text" name ="db">
<input type = "submit" value = "Create Database">
</form>
</body>
</html>
<?php 
} 
?>

I know this part is wrong or at least I think it is.

$mysql = "CREATE DATABASE IF NOT EXISTS '$_POST[db]'";

Any help would be greatly appreciated.

NogDog

All you do with that command is assign a string to variable $mysql. You then need to run that SQL statement via [man]mysql_query/man. Also, you should escape any form input that will be used as part of a query, for example:

$sql = "CREATE DATABASE IF NOT EXISTS `" . mysql_real_escape_string($_POST['db']) . "`";
$result = mysql_query($sql);

PS: Note that in MySQL you use the "back-tick" (left single quote) to quote column/table/database identifiers, not a "normal" single quote (which is for string literals).

malatang

I changed what you said but it still would'nt create a database.

$sql = "CREATE DATABASE IF NOT EXISTS `" . mysql_real_escape_string($_POST['db']) . "`"; 
$result = mysql_query($sql);

Is this the proper way to retrive the input from the form?

($_POST['db'])

Name: <input type = "text" name ="db"> 
<input type = "submit" value = "Create Database">

NogDog

Check the query result and see what happened:

$result = mysql_query($sql);
if($result == false)
{
   // for debug only, write something more robust for "real" version
   echo "Query failed: " . mysql_error() . "<br />\n$sql";
}