How can I insert variables in mysql SET when Updating?

Asked Nov 04 '21 at 16:45

Active Nov 04 '21 at 16:47

Viewed 93 times

What ways can I use variables in Mysql Update SET? I'm trying to pass variables but I don't know if that's really how it's done and if it's safe;

How am I doing:

$update = $this->pdo->prepare(
  "UPDATE `user_info`
  SET '$name' = ? //This way
  WHERE unique_token = ?"
);

$update->execute(array($value, $unique_token));

edited Nov 04 '21 at 16:47

Barmar

741,623
53
500
612

asked Nov 04 '21 at 16:45

Jonas Anton

That should work fine. – Barmar Nov 04 '21 at 16:47
@Barmar Do I run any risk doing it this way? – Jonas Anton Nov 04 '21 at 16:48
I generally prefer to use named parameters instead of `?`, but other than that it's the right way to do it. – Barmar Nov 04 '21 at 16:49
Wait a second. Why do you have `$name` inside quotes? You can't assign to a string. – Barmar Nov 04 '21 at 16:49
2

The main issue with `'$name'` is that columns should be surrounded by ticks, not single quotes, and make sure that you know that `$name` contains a safe value (either one you've specified or a value that you've checked against a list of potentials) – aynber Nov 04 '21 at 16:49
I didn't notice the variable `$name` earlier. See @aynber's caveats. – Barmar Nov 04 '21 at 16:50
3

See this for an example of dynamic column validation: https://stackoverflow.com/a/28288160/231316 – Chris Haas Nov 04 '21 at 16:55

How can I insert variables in mysql SET when Updating?

0 Answers0