Placing "From ?" does not work in PDO

Asked Mar 29 '17 at 16:26

Active Mar 29 '17 at 16:26

Viewed 20 times

Why placing a "?" in front of "FROM" does not work, while in other places it works?

query = "SELECT nome_cliente 
         FROM ?
         ORDER BY nome_cliente";

$rows = $this->db->prepare($query);
$rows->execute([$id]);

The error it gives is this:

SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '? ORDER BY nome_cliente' at line 1

asked Mar 29 '17 at 16:26

Luís Alves

1

This should not work. Specify the table – Rotimi Mar 29 '17 at 16:28
Show the code of where it works – Rotimi Mar 29 '17 at 16:28
it only works if I put the variable directly in the query, like so: query = "SELECT nome_cliente FROM $id ORDER BY nome_cliente"; but like this is prone to sql injection – Luís Alves Mar 29 '17 at 16:32
2

Basicly placeholder are for **values** NOT for creating **sql syntax**. Use them only for **values**. Here read this http://stackoverflow.com/questions/11312737/can-i-parameterize-the-table-name-in-a-prepared-statement#11327831 – JustOnUnderMillions Mar 29 '17 at 16:35
1

@LuísAlves, why are you accepting a table name from users in the first place? – ChrisGPT was on strike Mar 29 '17 at 16:36
@Chris the table is defined by the user by choosing in a drop down selection. This sets a global variable. – Luís Alves Mar 29 '17 at 16:47
Ok got it guys/girls, can't placehold table names. Will sanitize manually. – Luís Alves Mar 29 '17 at 16:49
This is one reason not to have lots of identical tables. – Rick James Apr 01 '17 at 00:41

Placing "From ?" does not work in PDO

0 Answers0