SQL请求取决于下拉菜单

Question

I'm having a small problem that's been annoying me for some hours now about a dropdown. So, I have a dropdown which is filled thanks to a SQL request and now I want to get the selected answer to do another SQL request but I'm having troubles with that ... Here is my code.

<?php
    try
    {
        $bdd = new PDO('mysql:host=localhost;dbname=PSF;charset=utf8','user','pass');
    }
    catch (Exception $e)
    {
        die('Erreur : ' . $e->getMessage());
    }

    echo 'poil';
    $choiceMicroscope = $bdd->query('select table_name from information_schema.tables where table_schema="PSF"');

?>
    <form method="POST" action="test3.php">
    <select name="Microscope">


    <?php

    while($choice = $choiceMicroscope->fetch())
    {
        ?>
        <option value="<?php echo $choice['table_name']; ?>"><?php echo $choice['table_name']; ?></option>
        <?php
    }
    ?>
    </select>
    <input type="Submit" value="Send" name="Send">
    </form>

    <?php

    if(isset($_POST['Microscope']) and isset($_POST['Send']))
        $nom=$_POST['Microscope'];
    else
        $nom="";

    //On vérifie si les champs sont vides
    if(empty($nom))
        echo '<font color = "red">The Microscope field should not be empty !</font>';
    else
    {
        echo $nom;
        echo "là";
        $test = $bdd->query('Select * from ".$nom." where ObjMagn="40x" and NumberBead = 2;');
        echo "prout";
        echo gettype($test);
        $test2 = $test->fetchAll();
        echo "ici";
        print_r($test2);
        echo $_POST['Microscope'];
    }
    ?>

When I test my request, I get

AxioObserverlàbool(false) proutboolean

which means that my request is not working ...

Any ideas ? Thanks !

Answer 1

Your query isn't as you expect. You are using single quotes so the variable isn't being concatenated.

$test = $bdd->query('Select * from ' . $nom . ' where ObjMagn="40x" and NumberBead = 2;');

This also is still likely to fail.

1. Why give the user the ability to choose the table?
2. You also are open to SQL injections with this.
3. If the value is empty your default value is empty, which will make the query fail.