How to create unique database name from sql query

Question

I need to create separate database for different users.The database name would be that user's name. I tried the following

$user=preg_replace('#[^A-Za-z0-9]#','',$_GET['u']); 

if(! $connect_dude )
 {
  die('Could not connect: ' . mysqli_error());
 }
else{
  echo 'Connected successfully<br />';
 }

$sql2 = "CREATE DATABASE '.$user.'";
$query2=mysqli_query($connect_dude,$sql2);
if($query2===TRUE){
 echo "Database created";
}
else{
 echo "Not created";
}

but it doesn't work.

If I use static name for database,that works.That create database. But I need different database name for different user.

Please help.

Thanks in advance.

Do you really need to create an entire new database for each user? Normally you'd just have a users table and reference it with foreign keys. — Quentin
– Quentin, Commented Sep 25, 2014 at 20:31
Remove the quotes and dots '.$user.' and use backticks ` around that variable. — Funk Forty Niner
– Funk Forty Niner, Commented Sep 25, 2014 at 20:34
@Fred-ii-You are the savior.You are the best.You helped mw with my last ques. too.It worked.Please put that on answer sec.And,I would choose this as answer — Salim Khan
– Salim Khan, Commented Sep 25, 2014 at 20:38
@Quentin Yes I do.Because I need lots of table on that user's database — Salim Khan
– Salim Khan, Commented Sep 25, 2014 at 20:41

Funk Forty Niner · Accepted Answer · 2014-09-26 01:09:21Z

2

"@Fred-ii-You are the savior.You are the best.You helped mw with my last ques. too.It worked.Please put that on answer sec.And,I would choose this as answer"

As per OP's request:

Remove the quotes and dots '.$user.' and use backticks around the variable.

$sql2 = "CREATE DATABASE `$user`";

Tables and column identifiers require either no quotes or backticks.

Although it is best using backticks, should the variable contain a reserved keyword, a space, a hyphen or any other character(s) that SQL may not agree with.

Add or die(mysqli_error($connect_dude)) to mysqli_query()

which would have signaled the error.

edited Sep 26, 2014 at 1:09

answered Sep 25, 2014 at 20:45

Funk Forty Niner

74.2k14 gold badges71 silver badges146 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Marc B · Accepted Answer · 2014-09-25 20:31:52Z

2

If $user is foo, then you're trying to create a database named .foo.

Try any of these instead:

$sql2 = "CREATE DATABASE '$user'";
$sql2 = "CREATE DATABASE '{$user}'";
$sql2 = "CREATE DATABASE '" . $user . "'";

And note that even though you're filtering $_GET['u'] to be alpha-numeric only, you can STILL cause SQL syntax errors, e.g. consider someone passing in u=table or 01234. Neither of those are valid DB (or table, or field) names.

answered Sep 25, 2014 at 20:31

Marc B

362k44 gold badges433 silver badges508 bronze badges

2 Comments

Pred Over a year ago

And use backticks instead of single quotation marks

Salim Khan Over a year ago

none of them worked.but using $user it worked,as suggested by Fred-ii.Thanks though

Collectives™ on Stack Overflow

How to create unique database name from sql query

2 Answers 2

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related