PHP : placeholder not working for identifier in pdo

Asked Oct 17 '17 at 08:41

Active Oct 17 '17 at 08:41

Viewed 29 times

I am putting a placeholder for an identifier, and to sanitize the table variable I have done:

$table = "users";
$table = "`".str_replace("`","``",$table)."`";

and done this to run my query:

$stmt = $dbconn->prepare("SELECT * FROM ? WHERE username = ?");
$stmt->execute([$table, "irfan"]);

This is the error I am receiving:

check the manual that corresponds to your MariaDB server version for the right syntax to use near ''`users`' WHERE username = 'irfan''

asked Oct 17 '17 at 08:41

Irfan Sindhi

1

You can't use `?` in table names – Carl Binalla Oct 17 '17 at 08:42
1

You can't bind table or column names, only values. – Qirel Oct 17 '17 at 08:42
@Qirel . Yes, I know that, so thats why I have sanitized the variable for it to fit in. Isn't that possible? – Irfan Sindhi Oct 17 '17 at 08:43
1

You haven't really sanitized it. It should be whitelisted, you can't bind it at all. – Qirel Oct 17 '17 at 08:44
No it's not a data type `PDO` prepared only handles data. – S4NDM4N Oct 17 '17 at 08:44
Then how do I whitelist it? – Irfan Sindhi Oct 17 '17 at 08:45
Most likely you just don't need it. There is no use case where you need a query like this. – Your Common Sense Oct 17 '17 at 08:47
@YourCommonSense I'm following your tutorial https://phpdelusions.net/pdo#why – Irfan Sindhi Oct 17 '17 at 08:49
@IrfanSindhi My tutorial is on how to use PDO, not on the basic PHP/mysql architecture. if your query is not an artificial sketch but a real one, then you are doing something wrong. – Your Common Sense Oct 17 '17 at 08:52
why do you think you need a query like this? – Your Common Sense Oct 17 '17 at 09:00
@YourCommonSense Not for any specific purpose. I was just playing around with placeholders. – Irfan Sindhi Oct 17 '17 at 09:03
Well now you know that you cannot use placeholders for the table names. – Your Common Sense Oct 17 '17 at 09:05
@YourCommonSense Yes, I do. Thank you. – Irfan Sindhi Oct 17 '17 at 09:07

0 Answers0