Question

I’ve created following code & I can’t seem to find out what’s wrong with it, any help would be greatly appreciated.

<?php

$con = mysql_connect("host","user","password");

mysql_select_db("Stores", $con);

$street = mysql_query("SELECT Street FROM Sports WHERE Name = 'Nike'");

if (mysql_query("CREATE DATABASE $street", $con))
{
       echo "Success";
}

else
{
       echo "Fail";
}

mysql_close($con);

i keep getting fail, can anyone point me in the right direction?

Answer 1

There are many problems with this code:

1. this may not be very relevant at first, but the php mysql extension is marked deprecated, please switch to mysqli or better still, PDO as is also indicated in the official documentation. Deprecated means that it’s only there to support legacy code (and that implies that it should not be used in new code) and that it will disappear at some point in the future. I suggest PDO as it’s a much more mature, flexible and universal database interface, if you are going to invest time in learning something, PDO is definitely the way to go. Pay special attention to prepared statements, they will help you avoid all kinds of problems without having to fumble with the various escape functions.
2. mysql_query returns a query result (as a resource) that you should read eg with some kind of fetch command – see the doc for PDO’s query() method here
3. I haven’t got the slightest idea why you would want to create a new database on your server named after the street you found via a query? You should probably explain what your intention is, I’m quite sure this isn’t going to do what you want it to do.

EDIT based on the comments:

For me the main advantages of switching to PDO are

• future-proofness: with the mysql_ extension you’ll upgrade php one day and the extension will be gone, forever. That won’t happen with PDO anytime soon.
• support for multiple databases: traditionally each database brand was served by its own proprietary extension in mysql. PDO unifies all these extensions which means that with 1 API you can work with most common databases in existence. Note that it doesn’t iron out dialect differences between these databases, but having one API for them all is definitely a big plus.
• PDO actively encourages you to use prepared statements, which are generally recognized as a bulletproof yet simple protection against all kinds of security issues like SQL injection – no need for all that escaping nonsense that you’ll need to do to make regular SQL statements somewhat safe.

Regarding the remark about creating a database for each user, I really think you need to go through some introductory material wrt relational databases. Most commonly an application is backed by one database containing in most cases a fixed set of tables (eg store, customer, order, orderitems) with relations between them. Eg a store has many customers, each of which have one or more orders, each of which contain one or more items. All data is fetched by utilizing these relations via queries, using joins to extract for example all items belonging to one order, or to list all orders associated with one customer. The important thing here is that in all but the most exceptional cases there ‘s just one table per data type. That is, all customers are stored in just one table, all orders are stored in just one table, and so on.

I have no time to read all of it, but databaseprimer.com might be helpful to get you started with these concepts.