databases:school
table :student
table :teacher
select name="booktype"
$selectOption = $_GET['booktype'];
can I use? ==> select * from **$selectOption** where class = 3A
Asked
Active
Viewed 34 times
-2
Eddie
- 26,593
- 6
- 36
- 58
user3592689
- 1
- 1
-
it would be better to use `switch` – Milan Halada May 19 '14 at 08:14
-
possible duplicate of [Can PHP PDO Statements accept the table name as parameter?](http://stackoverflow.com/questions/182287/can-php-pdo-statements-accept-the-table-name-as-parameter) – Milan Halada May 19 '14 at 08:16
1 Answers
0
yes you can:
$selectOption = pg_escape_string($_GET['booktype']);
use "select * from {$selectOption} where class = 3A"
or "select * from ".$selectOption." where class = 3A"
Viscocent
- 2,024
- 2
- 19
- 26
-
if it helps, you can check the `check` button left-side of my answer – Viscocent May 19 '14 at 08:15
-
1tables and columns cant be used as parameters - see: http://stackoverflow.com/questions/182287/can-php-pdo-statements-accept-the-table-name-as-parameter – Milan Halada May 19 '14 at 08:15
-
NOTE: You cannot use a prepared parameter for the table name! You have to sanitize the table name yourself before using it in the SQL query. – enricog May 19 '14 at 08:15