This exercise needs PHP, pdo_mysql and a test MySQL database. Set DB_HOST, DB_PORT, DB_DATABASE, DB_USERNAME and DB_PASSWORD for a dedicated practice account; keep the password out of source code. The practice account needs CREATE TEMPORARY TABLES permission. The temporary table disappears when the connection closes.
Keep values separate from SQL
Do not concatenate user input into SQL. A prepared statement separates the query structure from the supplied values. Placeholders represent values, not table or column names; use an allowlist when selecting those dynamically.
A runnable example
Save this code in demo.php. Both insertion and lookup use parameters. The result contains the name Reza.
<?php
$dsn = sprintf("mysql:host=%s;port=%d;dbname=%s;charset=utf8mb4",
getenv("DB_HOST") ?: "127.0.0.1",
(int) (getenv("DB_PORT") ?: 3306), getenv("DB_DATABASE"));
$db = new PDO($dsn, getenv("DB_USERNAME"), getenv("DB_PASSWORD"), [
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
PDO::ATTR_EMULATE_PREPARES => false,
]);
$db->exec("CREATE TEMPORARY TABLE practice_users (name VARCHAR(100), email VARCHAR(254))");
$insert = $db->prepare("INSERT INTO practice_users VALUES (?, ?)");
$insert->execute(["Reza", "reza@example.test"]);
$query = $db->prepare("SELECT name FROM practice_users WHERE email = :email");
$query->execute(["email" => "reza@example.test"]);
print_r($query->fetchAll(PDO::FETCH_ASSOC));Practice
Run php demo.php, insert another user and change the lookup email. An unknown email produces an empty array. In a real application, keep credentials out of public source files and do not expose internal database errors to visitors.
Check your understanding
Can a PDO placeholder represent a table name, an email value, or a complete SQL statement?
An email value. The SQL structure must be established separately.