RE: [PHP] Whats wrong with this query?
| From: | Wouter van Vliet | Date: | Mon, 10 Nov 2003 18:10:56 +0000 |
| Subject: | RE: [PHP] Whats wrong with this query? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-169064@lists.php.net to get a copy of this message | ||
> -----Original Message-----
> From: Dave Carrera [mailto:dave@ephgroup.com]
> Sent: maandag 10 november 2003 17:45
> To: php-general@lists.php.net
> Subject: [PHP] Whats wrong with this query?
>
> $addamysqluser = mysql_query("grant
> select,insert,drop,update,delete,create,index,alter on $_POST[f2] to
> $_POST[f2]@10.0.0.13 IDENTIFIED by $_POST[f3]");
>
> What is wrong with the above php based mysql_query ?
>
The value you use for the IDENTIFIED BY clause (which is, of course, the
password) should be quoted in mysql because it is a value. Both table and
username are sortoff 'objects'. Try this:
--------
$Query = 'GRANT select, insert, drop, update, delete, create, index, alter
ON '.$_POST['f2'].'
TO '.$_POST['f2'].' IDENTIFIED BY
"'.mysql_escape_string($_POST['f3']).'"';
mysql_query($Query);
if (mysql_error()) print mysql_error();
--------
What I also just noted was that you use $_POST[f2] twice, if you are not
also creating a table with the same name as the user this is probably not
what you meant. It might just, but it looks odd to me.
Wouter