0

I'm trying to prepare the following code:

foreach((array)$problem as $word) { //cycles through each word in the problem, grabs tag name like word, looking through each separate tag table
    foreach((array)$tables as $table) { //cycles through list of keyword tables, checks keywords against tables
        $query = $mysqli->prepare("SELECT ?.name FROM ? WHERE ?.words LIKE '?'"); //grabs table name where keyword exists
        $query->bind_param('ssss',$table,$table,$table,$word);     
        $query1 = $query->execute();
        $resultThree::fetch_assoc($query1);
            if(!is_null($resultThree)) { //if keyword exists
                array_push($pretag, $resultThree['name']); //push to pretags
            }
    }
}

It returns saying "Call to a member function bind_param() on a non-object in /home/whatpzcp/public_html/test/search.php on line 25" (the prepared statement line). Apparently this means the MySQL didn't return anything, but this same code worked fine before I was using prepared statements and doesn't anymore, which is what is confusing me.

Go easy on me as this is my first program! Also, do I need to prepare ALL MySQL statements or just ones that deal with user input?

1 Answers1

0

According to the PHP docs, you may not use ? binding variables "for identifiers (such as table or column names), in the select list that names the columns to be returned by a SELECT statement, or to specify both operands of a binary operator such as the = equal sign."

dcsohl
  • 7,186
  • 1
  • 26
  • 44