A php code able to exec all SQL code - php

Question

I'm making an intranet.
Only admin have access to the page i want to build now :
I have a page with a textarea. When they click on the send button, it comming to a PHP page to send a req like "UPDATE ... " or "SELECT ...".
He can write the SQL request he want. It's supposed to works.
I want it to work : If it's an update i need to return he if it's ok, if its a select i need to return a table.
But i need it to be able to exec complex request like :
SELECT numfou,
(SELECT COUNT(*)
FROM PROPOSER P
WHERE P.numfou = F.numfou) AS NB_PROD
FROM FOURNISSEUR F;
(net exemple).<br/>
Do you know a PHP code to exec any SQL req?

Answer 1

I suggest this code i make (If you think it can be update say it :D) :
<?php
function requette($req){
$premierMot = explode(" ", $req)[0];
switch(strtoupper($premierMot)){
case "SELECT":
return select($req);
break;
case "UPDATE":
case "DELETE":
case "INSERT":
return updateDeleteInsert($req);
break;
}
}
function select($req){
$bdd = new PDO('mysql:host=localhost;dbname=spb', 'root', '');
// ON DETERMINE SI LE CLIENT RECHERCHE DANS CHAMPS EN PARTICULIER OU TOUT
$explosion = preg_split('/[;, \n]+/', $req);
$veuxTout = false;
for($cpt=0;$cpt<count($explosion);$cpt++){
if(strtoupper($explosion[$cpt]) == "*"){
$veuxTout = true;
break;
}
}
// SI IL NE VEUX PAS TOUT ON PREVOI UN TABLEAU DE DEMANDE
$demande = array();
for($cpt=1;$cpt<count($explosion);$cpt++){
if(strtoupper($explosion[$cpt]) == "FROM"){
break;
}
else{
array_push($demande,$explosion[$cpt]);
}
}
// ON CHERCHE LE NOM DE LA TABLE
$table = "";
for($cpt=0;$cpt<count($explosion);$cpt++){
if(strtoupper($explosion[$cpt]) == "FROM"){
$table = $explosion[$cpt+1];
break;
}
}
// ON CHERCHE LES TITRES DE LA TABLE
$sql = "SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='$table';";
$res = $bdd->query($sql);
$titres = array();
while($resultat = $res->fetch()){
array_push($titres,$resultat['COLUMN_NAME']);
}
$res = $bdd->query($req);
$table = "<table>";
while($resultat = $res->fetch()){
$table .= "<tr>";
if($veuxTout == true){
for($cpt=0;$cpt<count($titres);$cpt++){
$table .= "<td>".$resultat[$titres[$cpt]]."</td>";
}
}
else{
$ok = false;
for($cpt1=0;$cpt1<count($titres);$cpt1++){
for($cpt2=0;$cpt2<count($demande);$cpt2++){
if(strtoupper($titres[$cpt1]) == strtoupper($demande[$cpt2])){
$table .= "<td>".$resultat[$titres[$cpt1]]."</td>";
$ok = true;
}
}
}
}
$table .= "</tr>";
}
$table .= "</table>";
return $table;
}
function updateDeleteInsert($req){
$bdd = new PDO('mysql:host=localhost;dbname=spb', 'root', '');
try {
$req = $bdd->prepare($req);
$req->execute();
return "oui";
}
catch(PDOException $e){
return "non";
}
}
$req = htmlentities($_POST['req']);
echo requette($req);
?>