开发者

what's wrong with this single PDO?

开发者 https://www.devze.com 2023-03-16 11:26 出处:网络
Here the thing, other PDO works well, but this one doesn\'t. I have tried with execute(array(\':t\'=>$table));

Here the thing, other PDO works well, but this one doesn't. I have tried with

execute(array(':t'=>$table));

with no success. Ideas?.

public function __construct($table){
        try{
                $pdocnx = new PDO("mysql:host=localhost;dbname=sigcat",'root','');
                $stmt = $pdocnx->prepare('select * from sigcat.:t');
                $stmt->bindParam(':t', urldecode($table), PDO::PARAM_STR,45);
                $stmt->execute();
                $row = $stmt->fetchAll(PDO::FETCH_ASSOC);
                var_dump($row);
        }catch(Exception $e){
            echo $e->getMes开发者_如何转开发sage();
        }   

    }

I got many records in 'supplies' but it returns array(0) { }. I'm getting the 'table' parameter with $_GET['table']. No exceptions though.


You can't bind table names, only values.

Maintain a list of valid names and ensure the string is present in the valid list.

If you can't build a list of valid names, you are probably doing something wrong.


You can't bind tables, so you can do a sneaky trick like this:

public function myFunction($table){
    $st = "SELECT FROM `" . $table ."` ..some sql";
    $statement->prepare($st);
    $statement->execute();

} 

Hope this helps.

0

精彩评论

暂无评论...
验证码 换一张
取 消