Can I parameterize the table name in a prepared statement?

by

Short answer to your question is “no”.

In the strictest sense, at the database level, prepared statements only allow parameters to be bound for “values” bits of the SQL statement.

One way of thinking of this is “things that can be substituted at runtime execution of the statement without altering its meaning”. The table name(s) is not one of those runtime values, as it determines the validity of the SQL statement itself (ie, what column names are valid) and changing it at execution time would potentially alter whether the SQL statement was valid.

At a slightly higher level, even in database interfaces that emulate prepared statement parameter substitution rather than actually send prepared statements to the database, such as PDO, which could conceivably allow you to use a placeholder anywhere (since the placeholder gets replaced before being sent to the database in those systems), the value of the table placeholder would be a string, and enclosed as such within the SQL sent to the database, so SELECT * FROM ? with mytable as the param would actually end up sending SELECT * FROM 'mytable' to the database, which is invalid SQL.

Your best bet is just to continue with 

SELECT * FROM {$mytable}

but you absolutely should have a white-list of tables that you check against first if that $mytable is coming from user input.

More Related Contents:

  1. You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘WHERE `id` [closed]
  2. How can create Database using url or other method [duplicate]
  3. Problame with files on SQL
  4. Im trying to create some temporary tables in mysql using php
  5. How can I prevent SQL injection in PHP?
  6. SQL injection that gets around mysql_real_escape_string()
  7. How to include a PHP variable inside a MySQL statement
  8. How to apply bindValue method in LIMIT clause?
  9. SELECT COUNT(*) AS count – How to use this count
  10. How to resolve ambiguous column names when retrieving results?
  11. selecting unique values from a column
  12. I cannot get my login form to connect interact properly with mySQL database [closed]
  13. mysql_num_rows(): supplied argument is not a valid MySQL result resource [duplicate]
  14. Increment value in MySQL update query
  15. Create a dynamic mysql query using php variables
  16. How to separate DATE and TIME from DATETIME in MySQL?
  17. Do SQL connections opened with PDO in PHP have to be closed
  18. How to convert ISO8601 to Date format in php
  19. MySQL skipping first row
  20. How to reverse order output of a MySQL query
  21. How to generate unique id in MySQL?
  22. Fatal error: Call to a member function query() on null
  23. How would I implement a simple site search with php and mySQL?
  24. How to check if a value already exists to avoid duplicates?
  25. how do I get month from date in mysql
  26. php/mysql zip code proximity search
  27. Updating column so that it contains the row position
  28. MYSQL select a piece of a string and order by that piece
  29. Aggregated query without GROUP BY
  30. Limit pagination page number

Leave a Comment