0

I have been tasked to search a database using a PDO with prepared select statement i have been given which looks like this

SELECT * FROM ? WHERE ? = '?'

I have managed to get the PDO to conduct the search but it is totally incorrect, ive tried to use the examples I have seen on here but nothing seems to do the job here is how i temp fixed it to search for me

try {

//Create array of prepared sql commands to select * from db tables avoiding SQL Injection
$sql = $dbh->prepare("show tables");

$sql->execute();

if ( $sql->columnCount() > 0 )
{
  while ($row = $sql->fetch() )
  //$sqls[ $row[0] ] = "select * from " . $row[0] . ";";
    $sqls[ $row[0] ] = "select * from " . $row[0] . " where $fieldname = '?';";
    $sql = $dbh->prepare($sqls[$tablename]);
    $sql->execute()
}

and here is my attempt to use "?"

try {

//Create array of prepared sql commands to select * from db tables avoiding SQL Injection
$sql = $dbh->prepare("show tables");

$sql->execute();

if ( $sql->columnCount() > 0 )
{
  while ($row = $sql->fetch() )
  //$sqls[ $row[0] ] = "select * from " . $row[0] . ";";
    $sqls[ $row[0] ] = "select * from ? where '?' = '?';";
    $sql = $dbh->prepare($sqls[$tablename]);
    $sql->bindParam(1,$tablename);
    $sql->bindParam(2,$fieldname);
    $sql->bindParam(3,$celldata);
    $sql->execute()
}

this of course didn't work, i tried the 's' method to bind the parameter that didn't work either i know there's definitely something up with [ $row[0] ] I understand this goes to the first row of the table, but do not understand where it fits in with the goal of creating something like this

SELECT * FROM ? WHERE ? = '?'

any help or pointers in the right direction would be really appreciated, thank you so much

Phiter
  • 14,570
  • 14
  • 50
  • 84
Hash Velani
  • 17
  • 5
  • 4
    You cant bind table names in prepared statements – Mihai Jan 24 '16 at 20:30
  • 5
    You cannot bind table or column names in Prepared Statements. http://stackoverflow.com/questions/182287/can-php-pdo-statements-accept-the-table-or-column-name-as-parameter/15990488#15990488 – Charlotte Dunois Jan 24 '16 at 20:34
  • awesome thanks for your reply mate, that puts me partly at ease over all of this, everything i have read so far states exactly that, you cant bind table names in prepared statements. thanks so much for the confirmation really appreciate it – Hash Velani Jan 24 '16 at 20:37
  • 1
    also, you can't bind a value to "?" if it's quoted... it will see it as a string and won't bind a parameter to it – Florian Humblot Jan 25 '16 at 08:29

0 Answers0