-1

Normally i use this code, it's work good.

<?PHP
include("connect.php");
$xxx = "275";
$sql = 'SELECT * FROM test_table WHERE number <= ? order by id desc';
$statement = $db_mysqli->prepare($sql);
$statement->bind_param('s', $xxx);
$statement->execute();
$result = $statement->get_result();
$row = $result->fetch_array(MYSQLI_ASSOC);
$number = $row['number'];
echo $total_price;
?>

Then i apply code by use php var for select table. like this

<?PHP
include("connect.php");
$xxx = "275";
$table_name = "test_table";
$sql = 'SELECT * FROM ? WHERE number <= ? order by id desc';
$statement = $db_mysqli->prepare($sql);
$statement->bind_param('ss', $table_name , $xxx);
$statement->execute();
$result = $statement->get_result();
$row = $result->fetch_array(MYSQLI_ASSOC);
$number = $row['number'];
echo $total_price;
?>

But not get any data, how can i do ?

reswe teryuio
  • 117
  • 1
  • 1
  • 8
  • 1
    this does not make any sense. Apart from the fact that you can't, why would you want to bind to a table name? I really hope you aren't passing the table name via a form or any medium that can be manipulated by a user – Rotimi Aug 06 '18 at 04:26
  • Possible duplicate of [Can I parameterize the table name in a prepared statement?](https://stackoverflow.com/questions/11312737/can-i-parameterize-the-table-name-in-a-prepared-statement) – mickmackusa Aug 06 '18 at 05:24
  • Always search exhaustively before posting a new question. Stackoverflow does not need more duplicate questions. – mickmackusa Aug 06 '18 at 05:25

1 Answers1

1

You cannot bind to a table name. You will need to write your code as:

$table_name = "test_table";
$sql = "SELECT * FROM $table_name WHERE number <= ? order by id desc";
$statement = $db_mysqli->prepare($sql);
$statement->bind_param('s', $xxx);
Nick
  • 138,499
  • 22
  • 57
  • 95