What are the potential pitfalls of extracting table names from CSV files in a PHP script for database import?

One potential pitfall of extracting table names from CSV files in a PHP script for database import is that the table names may not be sanitized or validated properly, leading to SQL injection vulnerabilities. To mitigate this risk, it is important to validate and sanitize the extracted table names before using them in SQL queries. 

// Example of validating and sanitizing table names extracted from CSV files
$csvTableName = $_POST['table_name']; // Assuming the table name is extracted from a form submission

// Validate the table name
if (!preg_match('/^[a-zA-Z0-9_]+$/', $csvTableName)) {
    die("Invalid table name");
}

// Sanitize the table name to prevent SQL injection
$cleanTableName = mysqli_real_escape_string($connection, $csvTableName);

// Use the sanitized table name in SQL query
$sql = "CREATE TABLE $cleanTableName (id INT AUTO_INCREMENT PRIMARY KEY, name VARCHAR(255))";
mysqli_query($connection, $sql);

Keywords

CSV files table names PHP script database import potential pitfalls

Related Questions