php-pdoHow to bind table name in PHP PDO
You can't bind table names with PDO, but you can use white filtering and direct string insertion:
$allowed = ['test', 'users', 'messages'];
$table = 'test';
if ( in_array($table, $allowed) ) {
$st = $pdo->prepare("SELECT * FROM {$table}");
$st->execute();
// ...
}ctrl + c$allowedlist of allowed table names (it is important to use this white filter for safety) | $tabletable name we want to "bind" |
$pdo->prepareprepare given query to execute | $st->execute(run query on the server |
More of Php Pdo
- How to get results after PHP PDO statement execute()
- Fetch single column value with PHP PDO
- Set charset in PHP PDO
- Commit transaction in PHP PDO
- Set execution timeout with PHP PDO
- Get last query error with PHP PDO
- Bind current datetime with PHP PDO
- Escape string with PHP PDO
- Enable exceptions in PHP PDO
- Get current database name with PHP PDO
See more codes...