How can the file name parameter be correctly incorporated into the SQL statement for loading data from CSV files into a MySQL database in PHP?

When loading data from CSV files into a MySQL database in PHP, the file name parameter needs to be properly incorporated into the SQL statement to ensure the correct file is being loaded. This can be achieved by using prepared statements and binding the file name parameter as a variable in the SQL query. This prevents SQL injection attacks and ensures the file name is handled securely. 

// Assuming $filename contains the name of the CSV file
$filename = "example.csv";

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=database", "username", "password");

// Prepare the SQL statement with a placeholder for the file name
$stmt = $pdo->prepare("LOAD DATA INFILE ? INTO TABLE table_name FIELDS TERMINATED BY ',' LINES TERMINATED BY '\n' IGNORE 1 LINES");

// Bind the file name parameter to the placeholder
$stmt->bindParam(1, $filename);

// Execute the SQL statement
$stmt->execute();

Keywords

PHP SQL statement file name parameter CSV files MySQL database

Related Questions