ALTER TABLE Customers ADD - not allowed in name

Discussion in 'PHP' started by Matt18, Mar 15, 2012.

0
  1. #1
    Hi

    I am having problems adding E-mail to the database using ALTER TABLE. All other column names are added ok, but as soon as there is – inside the name, the column is not added. Can you help me out please?

    Thanks!

    mysql_query("ALTER TABLE Customers ADD $ColumnName $ColumnType");
    Code (markup):
     
    Matt18, Mar 15, 2012 IP
  2. djacobs

    djacobs Well-Known Member

    Messages:
    238
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    140
    #2
    I'm assuming this is PHP, if so it should have been posted there. If so you problem show what the variables are, unless they are global variables.

    Anyhow you should problem filter what is injected into your database for security reasons and for issues like now.

    What I can think of is to use backticks but thats not ANSI complaint so since it looks like you are using php try 

    mysql_query("ALTER TABLE Customers ADD mysql_real_escape_string($ColumnName), $ColumnType");
    Code (markup):
     
    djacobs, Mar 16, 2012 IP
  3. Matt18

    Matt18 Guest

    Messages:
    591
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #3
    I do that already when defining the $ColumnName. So when I use it in mysql_query it is already "escaped". I don't think the problem is in php because all other column names are inserted normally. The only problem is with names that contain - character. Any idea what could be wrong? Thank you!
     
    Matt18, Mar 18, 2012 IP
  4. djacobs

    djacobs Well-Known Member

    Messages:
    238
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    140
    #4
    The problem is more than likely with your PHP because a hyphen(-) needs to be escaped. But could also be how your MySql is configured because Having a hyphen in the table name is a bad idea because its a nonstandard table name.

    If I were you I would filter and change hyphen (-) to an underscore (_).

    Backticks could work to, but like I said it is also non-standard code. You could also try addslashes()

    You should post how you escape the variable $ColumnName
     
    Last edited: Mar 18, 2012
    djacobs, Mar 18, 2012 IP
  5. sarahk

    sarahk iTamer Staff

    Messages:
    28,899
    Likes Received:
    4,555
    Best Answers:
    123
    Trophy Points:
    665
    #5
    change the hypen - to an underscore _ and you should be fine
     
    sarahk, Mar 20, 2012 IP
  6. Matt18

    Matt18 Guest

    Messages:
    591
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #6
    I'll do that. I was hoping I won't have to change that and then change it back everytime column name is shown...
     
    Matt18, Mar 27, 2012 IP