PHP variable as table name in SQL query

Question

Can a PHP variable be used as a table name in an SQL query? In my case the PHP variable that goes after FROM should be the value being sent from my JQuery code. I want the SQL query to change based on the value sent from JQuery (different value depending on which option of the select box is chosen).

$file_absolute = ---Placeholder for correct file path---;
include_once($file_absolute);
$mysql = new mysqli($db_host, $db_username, $db_password, $db_name);
$verb_value = $_POST['verb_value'];

$mysql->query("SET CHARACTER SET 'utf8'");

$result = $mysql->query("SELECT present_tense FROM $verb_value");

STOP. Don't do this. You're vulnerable to SQL injection attacks, and are just begging to get your server pwn3d. — Marc B
– Marc B, Commented Sep 19, 2012 at 15:14

andrewsi · Accepted Answer · 2012-09-19 15:14:41Z

4

You can do this, yes. Whether you want it is quite another matter - if you're adding user input to your SQL queries, you've got a huge SQL injection hole.

That said, with table names, you can implement a whitelist, and compare the passed values against that to get a measure of security.

You can't pass table names (or column names) as bound parameters, though - they need to be generated as part of the query.

answered Sep 19, 2012 at 15:14

andrewsi

10.7k132 gold badges37 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

David Grenier Over a year ago

Glad you answered this Andrew. I was about to go research binding methods.

programm3r Over a year ago

The user is never typing in anything. The value being sent is a value I send based on what option is selected by the user in a select box.

andrewsi Over a year ago

You're taking in data from $_POST['verb_value'] - what is there to stop a user from editing the value that's being submitted?

programm3r Over a year ago

@andrewsi I'm not sure how the user would edit the value. I'm using the following JQuery code: $('#verb').live('change', function() { $.post("loadTextBox.php", {verb_value: $(this).val()}, function(data) { $("#textbox").html(data.first); $("#textbox2").html(data.second); $("#textbox3").html(data.third); $("#textbox4").html(data.fourth); $("#textbox5").html(data.fifth); $("#textbox6").html(data.sitxh); },"json"); });

andrewsi Over a year ago

With tools like firebug, you can see what values are about to be submitted on a page, and edit them before submitting. Also, could I create a form locally that has your PHP page as it's action? Then I can enter whatever I want to.

|

David Grenier · Accepted Answer · 2012-09-19 15:14:49Z

0

A double-quoted string will parse any variables within it, so this will work. A single-quoted string would not.

However, this is generally not considered secure. I'm not sure if you can use a bindParam method to achieve this (I use PDO, not mysqli) as it's not actually a parameter.

answered Sep 19, 2012 at 15:14

David Grenier

1,2411 gold badge10 silver badges24 bronze badges

Collectives™ on Stack Overflow

PHP variable as table name in SQL query

2 Answers 2

8 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

8 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related