How to dynamically read MySQL database fields using PHP variables?

Dynamically obtain MySQL database fields using PHP variables

In PHP and MySQL database interaction, it is often necessary to read database fields dynamically. This article will explain how to use PHP variables and URL parameters to achieve flexible data access and avoid inefficient ways to modify the code every time.

Suppose that existing code reads data from a database "table" table named "abc" and displays the value of the "temp" field:

 <?php mysql_select_db("abc", $con);
$result = mysql_query("SELECT * FROM table");
while($row = mysql_fetch_array($result)) {
  echo $row[&#39;temp&#39;];
}
?>

In order to dynamically specify the fields to be read, we can use PHP's $_GET hyperglobal array to get the URL parameters. For example, pass the field name through the URL parameter field and visit http://example.com/script.php?field=name to read the "name" field.

The improved code is as follows:

 <?php mysql_select_db("abc", $con);
$fieldName = isset($_GET[&#39;field&#39;]) ? $_GET[&#39;field&#39;] : &#39;temp&#39;; // Default value temp
$result = mysql_query("SELECT * FROM table");
while($row = mysql_fetch_array($result)) {
  // Security check to prevent SQL injection if (preg_match(&#39;/^[a-zA-Z0-9_] $/&#39;, $fieldName)) {  
    echo isset($row[$fieldName]) ? $row[$fieldName] : &#39;The field does not exist&#39;; 
  } else {
    echo "Invalid field name";
  }
}
?>

This code first gets the value of field parameter from the $_GET array and assigns the value to $fieldName variable. If there is no field parameter, the default value "temp" is used. The key improvement is the addition of security checks , using the regular expression preg_match('/^[a-zA-Z0-9_] $/', $fieldName) to ensure that $fieldName only contains letters, numbers and underscores, effectively preventing SQL injection attacks. Finally, it checks if the field exists in the $row array, and if it does not exist, the output "field does not exist".

By modifying the URL parameters, different fields can be read dynamically without modifying the PHP code itself, and the code security is improved. Remember that in practical applications, stricter input verification and parameterized query are necessary security measures.

The above is the detailed content of How to dynamically read MySQL database fields using PHP variables?. For more information, please follow other related articles on the PHP Chinese website!