Building database and tables using php and user named variables

[c++learner]

Hello!

What I'm trying to do is allow a user to create a database and tables by supplying the database and table names through text fields. It is pretty generic unsecure at this point but I'm just trying to learn it currently and I am the only one that is using it. I can create the database by supplying the value in the text box and then using that value for the name of the DB. I am passing all values through POST requests...no session stuff. The first page grabs the DB name and then directs to the next page which grabs the table name and the number of fields. The third page includes a function that builds the text boxes which will be used to name the fields in the table and provides as many as the user wants. When the function writes out the text boxes it names them all the same "form_field" is the name, no array at this point. The final page is supposed to drop the DB because I created it in the beginning once the name was supplied in the text box. So I drop it and then recreate it, create the table, and then create the table fields. Everything works until the last page, it wont create the table or even drop the DB. Just for reference, I can echo all values on the final page such as DB name, table name, and the field names so everything is there, I just can't figure out how to build the table. It is basically the same concept as the PHPMyAdmin interface but way more generic with no OOP or session management, at least at this point. The code for my final page is below, please ignore the testing echo and variables scattered throughout it is a mess, however, there is not many lines of code at all. Thanks to everyone who gives me advice. Everything is correct such as the connect script because the DB gets created at first and the DB is in my phpadmin, just no tables.

<?php

include('connect.php'); 


if($_SERVER['REQUEST_METHOD'] == 'POST')
{

 if(isset($_POST['database_name']))
 {
   $arr = array();
   $dn = "$_POST[database_name]";
   $tn = "$_POST[table_name]";
   $fn = "$_POST[field_name]";
   //$val = "$_POST[value]";

// TEST PURPOSES
foreach($_POST[field_name] as $value){
$arr[] = $value;
//print_r(array_values($arr));
echo "Array-" . current($arr) . "<br>"; 
}

  }

// TESTING
  foreach($fn as $field){
   echo $field;
    }


echo "Database Name->" . $dn . "\n";
echo "<br>\n";
echo "Table Name->" . $tn . "\n";
echo "<br>\n";
//echo $val . "<br>";



// PROBLEM CREATING TABLE AND FIELDS
if(mysql_select_db($dn, $con)){
$d = "DROP DATABASE `$dn` IF EXISTS";
if (mysql_query("CREATE DATABASE `$dn`")){

$sql = "CREATE TABLE `$dn`.`$tn`";

foreach($_POST[field_name] as $value){
$arr[] = $value;
$sql .= "(current($arr) varchar(15),)";
   }
  }
 }
//FUTURE USE
/*
$sql = "SELECT * FROM `$dn`.`$tn`";
$result = mysql_num_rows($sql);
  if ($result == 0){
     echo "Created";
   }
*/


}
?>

[pritaeas]

You foreach loop for the columns will not generate a correct query. You'll need to use something like this:

$columns = array ();
foreach($_POST[field_name] as $value) {
  $columns[] = "$value VARCHAR(15)";
}
$sql .= '(' . explode(',', $columns) . ')';

[c++learner]

Thanks! I will give it a try and respond back with the results.

You foreach loop for the columns will not generate a correct query. You'll need to use something like this:

$columns = array ();
foreach($_POST[field_name] as $value) {
  $columns[] = "$value VARCHAR(15)";
}
$sql .= '(' . explode(',', $columns) . ')';