How to dynamically prepare sql statement which also dynamically include the fields name

Asked Dec 18 '17 at 15:18

Active Dec 18 '17 at 15:19

Viewed 36 times

How to prepare fields name dynamically in sql statement.

Here is my query but it return 500 error. Im guessing this is because I'm preparing names dynamically.

Is there any way to prepare fields name dynamically in sql statement.

if (!($update_stmt = $mysqli_scs->prepare("UPDATE `signs_sgn` SET ? = ? , ?=? WHERE (`signcode_sgn`= ?) LIMIT 1;"))) {
                echo "Prepare failed: (" . $mysqli_scs->errno . ") " . $mysqli_scs->error;
            }

Many Thanks

edited Dec 18 '17 at 15:19

Jens

67,715
15
98
113

asked Dec 18 '17 at 15:18

muhammed ikram

identifiers != strings. You can't prep a query with column/identifier placeholders. You will have to build that part of the query without placeholders. – bassxzero Dec 18 '17 at 15:19
You cannot add column names as place holder. You have to concate strings here – Jens Dec 18 '17 at 15:19
So what would be best alternative i should do which has no security risks. – muhammed ikram Dec 18 '17 at 15:22
The very best alternative is to not accept column names as user input. – apokryfos Dec 18 '17 at 15:31

How to dynamically prepare sql statement which also dynamically include the fields name

0 Answers0