创建列时出现sql语法错误

Question

I am trying to run the following query, but am getting a sql syntax error, but dreamweaver doesnt seem to be highlighting any error so im not sure where it is ?. thanks :-)

<?php
$form_id = $_POST[form_id];
    $query = mysql_query("
IF NOT EXISTS (SELECT * FROM INFORMATION_SCHEMA.COLUMNS
WHERE 
TABLE_NAME = 'email_history' 
AND COLUMN_NAME = `$form_id`)
BEGIN
 ALTER TABLE 'email_history' ADD `$form_id` VARCHAR( 255 ) NOT NULL
END;
") or die(mysql_error());
?>

Answer 1

Have a look at

‘$form_id`

You probably mean

`$form_id`

Update: Once more wrong quotes

'email_history'

should be

`email_history`

Remind: Backticks ` are for qualifiers (tablenames and such), where the apostroph ' is for values.

Answer 2

Here is the correct quotation format.

$query = mysql_query("
IF NOT EXISTS (SELECT * FROM INFORMATION_SCHEMA.COLUMNS
WHERE 
TABLE_NAME = 'email_history' 
AND COLUMN_NAME = '$form_id')
BEGIN
    ALTER TABLE `email_history` ADD `$form_id` VARCHAR( 255 ) NOT NULL
END;
") or die(mysql_error());

Answer 3

Try this.

$form_id = $_POST[form_id];
$query = mysql_query("
  IF NOT EXISTS (SELECT * FROM INFORMATION_SCHEMA.COLUMNS
    WHERE 
    TABLE_NAME = 'email_history' 
    AND COLUMN_NAME = '$form_id')
  BEGIN
    ALTER TABLE `email_history` ADD `$form_id` VARCHAR( 255 ) NOT NULL
  END;
") or die(mysql_error());

Also, just on side note, you should never directly use the values from User input into your SQL. This is to prevent SQL injection. Here are a few links on MySQL Injection which I found:

http://www.php.net/manual/en/security.database.sql-injection.php http://25yearsofprogramming.com/blog/2011/20110205.htm https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

Answer 4

<?php
$form_id = $_POST[form_id];
    $query = mysql_query("
IF NOT EXISTS (SELECT * FROM INFORMATION_SCHEMA.COLUMNS
WHERE 
TABLE_NAME = 'email_history' 
AND COLUMN_NAME = '$form_id')
BEGIN
 ALTER TABLE email_history ADD `$form_id` VARCHAR( 255 ) NOT NULL
END;
") or die(mysql_error());
?>

Answer 5

Everyone has focused on bad quoting, but is there any chance of this query to run? Does MySQL allow such conditional statements? I know this is possible in stored routines but I have never heard of such direct usage, so I would split this into two queries: column existence check and table alteration.

This will look like this:

<?php
$form_id = some_function_to_check_if_input_is_valid_etc($_POST[form_id]);
$exist_result = mysql_query("SELECT IF(NOT EXISTS(
    SELECT * 
    FROM    INFORMATION_SCHEMA.COLUMNS
    WHERE   TABLE_NAME  = 'email_history' 
    AND     COLUMN_NAME = '{$form_id}'
    ),1,0) AS should_alter_table
");
$row = mysql_fetch_assoc($exist_result);
if($row['should_alter_table']){
    mysql_query("ALTER TABLE email_history ADD `{$form_id}` VARCHAR( 255 ) NOT NULL");
}