Creating dynamic tables with MySQLi securely

Vote count:

0

I want to be able to create dynamic tables, for custom user surveys... like survey monkey... how would I go about create something like that?

Because I want to give the ability to the user to create the survey, with different amount of text fields, and different a option fields... I would need to create a custom table for each survey.

Would something like this be possible?

<?php

$table_name = 'survey_'.$_POST['surveyid'];

$query = 'CREATE TABLE ? (
            `responseid` INT NOT NULL AUTO_INCREMENT,
            `textarea1` TEXT NULL,
            `textarea2` TEXT NULL,
            `textarea3` VARCHAR(255) NULL,
            `drop_down1` VARCHAR(255) NULL,
            `drop_down2` VARCHAR(255) NULL,
            `bool1` BIT NULL,
            `bool2` BIT NULL,
        PRIMARY KEY (`responseid`))';

if($stmt = $mysqli->prepare($query)){
    $stmt->bind_param('s', $table_name);
    $stmt->execute();
    $stmt->close();
}else die("Failed to prepare");

?>

The above example comes back with "Failed to prepare", because I don't think I can prepare a table name... is there another work around using mysqli?

if(ctype_digit($_POST['surveyed']) && $_POST['surveyed']>0){

    $table_name = 'survey_'.$_POST['surveyid'];

    $query = 'CREATE TABLE '.$table_name.' (
            `responseid` INT NOT NULL AUTO_INCREMENT,
            `textarea1` TEXT NULL,
            `textarea2` TEXT NULL,
            `textarea3` VARCHAR(255) NULL,
            `drop_down1` VARCHAR(255) NULL,
            `drop_down2` VARCHAR(255) NULL,
            `bool1` BIT NULL,
            `bool2` BIT NULL,
        PRIMARY KEY (`responseid`))';

I know I can just try to sanitize the $_POST['surveyid'] (like I did above) but I prefer to prepare it if possible.

asked 47 secs ago

Arian

1,536