styfle/The-Harvest-Club — Issue #7: Update submit forms - use $db object
Author: styfle
Created: 2012-02-17 08:37:47+00:00
State: open

The Database class has a nice feature to escape your query for you. I haven't tested so tell me if it breaks.

// say you get $tablename and $first_name from $_REQUEST
$sql = "SELECT * FROM %s WHERE first_name = '%s';";
$r = $db->q($sql, array($tablename, $first_name));
// now do whatever you need to with result

That should get you started. See ajax.php for more.