-2

I'm having trouble figuring out what I'm doing wrong. If i use this set of code I get the result I intend:

$x =  $db->prepare('SELECT * FROM table LIMIT 2');
$x->execute();
print_r($x->fetchALL());

When I use this set of code I don't get anything in return:

$a = "table";
$b = "2";
$x =  $db->prepare('SELECT * FROM ? LIMIT ?');
$x->execute(array($a,$b));
print_r($x->fetchALL());

Is there something I'm missing? Thanks in advance.

SupperSam
  • 194
  • 1
  • 7

1 Answers1

2

Parameter placeholders can only be used to replace column values; not table names, column names, or other syntax elements (including LIMIT values).

In order to make your query dynamic with respect to things that can't be parameterized, you have to build it yourself, without PDO's help. However, you should still build it so that the values that can be parameterized, are paramerized.

Air
  • 8,274
  • 2
  • 53
  • 88