sYA4DjBk

1<?php
2    // This adds a variable without creating a new row in the data table
3    // Note: This version only works with mysql 5.6+  because of the "if not exists" column insert
4
5    // create connection to data base, info is stored in connect.php
6    require_once 'Connect.php';
7   
8    // store variables
9    // Strings must be escaped to prevent SQL injection attack.
10    $tablename      = $_POST['tablename'];
11    $columnname     = $_POST['columnname'];
12    $data           = $_POST['data'];
13    $datatype       = $_POST['datatype'];
14    $participantID  = $_POST['id'];
15    $hash           = $_POST['hash'];
16
17    // Make the sql query
18    $query = "";
19    for($i = 0; $i <= count($data); $i++) {
20        $columnname_i = "test";
21        $datatype_i = "varchar(100)"; //$datatype[$i];
22        $data_i = $datatype[$i]; //$data[$i];
23        $query .= "
24                insert ignore into `$tablename` (participantID) values ('$participantID');
25                alter  table `$tablename` add column if not exists $columnname_i $datatype_i;
26                update `$tablename` set `$columnname_i` = '$data_i' where participantID = '$participantID';
27                ";
28    };
29
30
31    // prevent people from editing the URL to fake the data
32    //$real_hash = md5($tablename . $columnname . $data . $datatype . $participantID);
33    //if($real_hash == $hash) { 
34        try {  
35            $sqlConnection->beginTransaction();
36            $sqlConnection->exec($query);
37            $sqlConnection->commit();
38            echo "Success";
39        } catch (Exception $e) {
40            $sqlConnection->rollBack();
41            echo "Writing to data base failed, error: " . $e->getMessage();
42        };
43    //}
44
45    // we're done now, so we can close the connection
46    $sqlConnection = null;
47?>