13

Is it possible to bind a table name?

I want to make a class to read the columns from a tables and, depending on field type, generate the form inputs for me. When I do $form = new form("users");, the constructor is supposed to start with getting the field names from the table with the following code:

class form{

    public function __construct($table, $skip = array("id")){
        $pdo = new PDO('mysql:host=localhost;dbname=site;',USER,PASS);

        $query = $pdo->prepare("DESCRIBE :table");

        $query->bindValue(':table', $table, PDO::PARAM_STR, strlen($table));

        $query->execute();

        while($field = $query->fetch(PDO::FETCH_NUM)){
            var_dump($field);
            echo "<br /><br />";
        }

        unset($pdo);
    }
}

This works just fine when I specify "users" instead of ":table" in the prepare statement, but the bind it's working, and I'm pretty sure it's because it's trying to bind a table name. Also, this needs to be binded because I'd like to have the ability to pass my table names through $_GET and the such.

0

2 Answers 2

12

Is it possible to bind a table name?

No.

You have to whitelist table names. I doubt you want to let a user to browse any table from your database.

Given you are using a class, it will be no-brainer to add a table name as a property. It will be simple, elegant and safe. Create an abstract parent class first

abstract class abstractTable {
    private $table;
    private $db;

    public function __construct($pdo){
        $this->db = $pdo;
    }
    public function describe() {
        return $db->query("DESCRIBE `$this->table`")->fetchAll();
    }
}

Then create a specific class for your table

class someTable extends abstractTable {
    private $table = 'sometable';
}

and so you will be able to get the required list of columns

$pdo = new PDO(...);
$table = new someTable($pdo);
$fields = $table->describe();

simple, concise, powerful, safe.

5
  • In that wiki in the section 'PDO Prepared statements and IN', why couldn't you replace the SQL string with a parameter for table? Mar 3, 2013 at 6:05
  • 1
    I didn't know there were tag wikis. That's convenient. Also, why would such a class be a waste of time?
    – user1846065
    Mar 3, 2013 at 6:11
  • After all of your edits, your answers make a lot more sense. I'll stick with a simple, bindless, PDO query since it'd take the same amount of statements as the class you mentioned, and make a global pdo variable. Also, the class isn't intended to make the form start-to-finish, it's just intended to create the inputs and labels for you with the correct input type, labels with correct "for"s, inputs with a maxlength equal to the max length of the field in the database, etc. As far as formatting goes, so long as you keep the HTML simple, all of the formatting can be done very easily in CSS.
    – user1846065
    Mar 3, 2013 at 20:24
  • @MisterMelancholy if it takes exactly the same amount of statements, you are not formatting your $table variable and thus allowing an injection. Mar 4, 2013 at 7:54
  • Yeah. You had another good point with "You don't want to let the user chose what table they see". If I need to white-list tables names, I don't need to sanitize the variable before comparison because if it doesn't match a a white-listed table name exactly, the SQL query won't be run, thus negating the need for SQL sanitization. Sorry for skipping that small detail in my previous comment.
    – user1846065
    Mar 4, 2013 at 8:17
1

There is a PDO wrapper class at - http://www.phpclasses.org/package/5997-PHP-Database-access-abstraction-layer.html that lets you do this (though I am new to PDO so maybe it isnt using prepared statements)

His suggested usage is:

 $db = new DatabaseConnection('someMysqlServer', 'user', 'pass', 'database');

 $result = $db->exec($db->filterForSql('SELECT * FROM '.$tableName.';'));

I would interested if others think this is a 'safe' way of using PDO or not.

7
  • 1
    Whatever class doing things like filterForSql is unusable dangerous crap. The site requires a registration, so, I cannot review it more throughly Mar 3, 2013 at 6:58
  • I'm surprised you say it is unusable crap when you haven't read the source code. Sorry, but there is a fair bit of conflicting information around this and I'd be interested in seeing a 'bulletproof PDO Database class' - do you have any recommendations? Mar 3, 2013 at 12:59
  • The very function you posted is more than enough to judge. An SQL query consists of many different parts and it's impossible to create a common filter for them all - filtering for one will break another and contrary. I have a bulletproof class for running mysql queries (not PDO based though, but it doesn't matter). You can find the link in my profile. The only real bulletproof class I know. Mar 3, 2013 at 13:14
  • Thanks for the class - looks interesting. I am still unconvinced that the original posters request cant be fulfilled though. Mar 3, 2013 at 14:07
  • I have added the code to my answer. Mar 3, 2013 at 14:18