Which tokens can be parameterized in PDO prepared statements?

by

You cannot parameterize table names, column names, or anything in an IN clause (thanks to c0r0ner for pointing out the IN clause restriction).

See this question, and subsequently this comment in the PHP manual.

More Related Contents:

  1. Can I bind an array to an IN() condition in a PDO query?
  2. PHP – Using PDO with IN clause array
  3. PDO Prepared Inserts multiple rows in single query
  4. PDO prepared statement – what are colons in parameter names used for?
  5. pdo prepared statements with wildcards
  6. Can I use a PDO prepared statement to bind an identifier (a table or field name) or a syntax keyword?
  7. Get last insert id after a prepared insert with PDO
  8. How do I use pdo’s prepared statement for order by and limit clauses?
  9. Insert multiple rows with PDO prepared statements
  10. Replacing mysql_* functions with PDO and prepared statements
  11. PHP PDO::bindParam() data types.. how does it work?
  12. Binding params for PDO statement inside a loop
  13. PDOstatement (MySQL): inserting value 0 into a bit(1) field results in 1 written in table
  14. Calling stored procedure with Out parameter using PDO
  15. When *not* to use prepared statements?
  16. Retrieve (or simulate) full query from PDO prepared statement
  17. PDO error: SQLSTATE[HY000]: General error: 2031
  18. Use of PDO in classes [duplicate]
  19. Error while using PDO prepared statements and LIMIT in query [duplicate]
  20. PDOException “could not find driver”
  21. Row count with PDO
  22. How to view query error in PDO PHP
  23. PHP PDO – Bind table name? [duplicate]
  24. How to debug PDO database queries?
  25. Resetting array pointer in PDO results
  26. Parametrized PDO query and `LIMIT` clause – not working [duplicate]
  27. Using htmlspecialchars function with PDO prepare and execute
  28. PDO::PARAM for type decimal?
  29. Alternative for mysql_num_rows using PDO
  30. PDO lastInsertId() always return 0

Leave a Comment