https://stackoverflow.com/questions/182287/can-php-pdo-statements-accept-the-table-or-column-name-as-parameter

Please see the following: http://us3.php.net/manual/en/book.pdo.php#69304

Table and Column names cannot be replaced by parameters in PDO.

In that case you will simply want to filter and sanitize the data manually. One way to do this is to pass in shorthand parameters to the function that will execute the query dynamically and then use a switch() statement to create a white list of valid values to be used for the table name or column name. That way no user input ever goes directly into the query. So for example:

function buildQuery( $get_var )
{
switch($get_var)
{
case 1:
$tbl = 'users';
break;
} $sql = "SELECT * FROM $tbl";
}

By leaving no default case or using a default case that returns an error message you ensure that only values that you want used get used.

-----------------------------

To understand why binding a table (or column) name doesn't work, you have to understand how the placeholders in prepared statements work: they are not simply substituted in as (suitably escaped) strings, and the resulting SQL executed. Instead, a DBMS asked to "prepare" a statement comes up with a complete query plan for how it would execute that query, including which tables and indexes it would use, which will be the same regardless of how you fill in the placeholders.

The plan for SELECT name FROM my_table WHERE id = :value will be the same whatever you substitute for :value, but the seemingly similar SELECT name FROM :table WHERE id = :valuecannot be planned, because the DBMS has no idea what table you're actually going to select from.

This is not something an abstraction library like PDO can or should work around, either, since it would defeat the 2 key purposes of prepared statements: 1) to allow the database to decide in advance how a query will be run, and use the same plan multiple times; and 2) to prevent security issues by separating the logic of the query from the variable input.

原来,表名和字段名不能在pdo中“参数化查询”的更多相关文章

  1. SQL Server 2008 R2——根据数据查找表名和字段名 根据脏数据定位表和字段

    =================================版权声明================================= 版权声明:原创文章 谢绝转载  请通过右侧公告中的“联系邮 ...

  2. mybatis动态调用表名和字段名

    以后慢慢启用个人博客:http://www.yuanrengu.com/index.php/mybatis1021.html 一直在使用Mybatis这个ORM框架,都是使用mybatis里的一些常用 ...

  3. SQL 查询所有表名、字段名、类型、长度、存储过程、视图

    -- 获得存储过程创建语句 select o.xtype,o.name,cm.text from syscomments cm inner join sysobjects o on o.id=cm.i ...

  4. sqlserver查询所有表名、字段名、类型、长度和存储过程、视图的创建语句

    -- 获得存储过程创建语句 select o.xtype,o.name,cm.text from syscomments cm inner join sysobjects o on o.id=cm.i ...

  5. Oracle 查询库中所有表名、字段名、字段名说明,查询表的数据条数、表名、中文表名、

    查询所有表名:select t.table_name from user_tables t;查询所有字段名:select t.column_name from user_col_comments t; ...

  6. oracle的表名、字段名、constraint名的长度限制分别是多少?

    文章出处:http://blog.csdn.net/haiross/article/details/38379615 Oracle:表名.字段名.constraint名的长度有限制 oracle 的命 ...

  7. ibatis动态的传入表名、字段名

    ibatis动态的传入表名.字段名,主要传入表名和字段名的不一致. Java代码: Map<String,Object> params = new HashMap<String,Ob ...

  8. SQL查询表,表的所有字段名,SQL查询表,表的所有字段名

    SQL查询表,表的所有字段名 2011-07-29 10:21:43|  分类: SQLServer |  标签:表  sql  字段   |举报 |字号 订阅   SQL查询表,表的所有字段名 SQ ...

  9. SQL添加表字段以及SQL查询表,表的所有字段名

    通用式: alter table [表名] add [字段名] 字段属性 default 缺省值 default 是可选参数 增加字段: alter table [表名] add 字段名 smalli ...

随机推荐

  1. Python3基础教程(二十)—— flask介绍

    基本概念 什么是Flask? Flask 是一个 web 框架.也就是说 Flask 为你提供工具,库和技术来允许你构建一个 web 应用程序.这个 web 应用程序可以是一些 web 页面.博客.w ...

  2. DROP SEQUENCE - 删除一个序列

    SYNOPSIS DROP SEQUENCE name [, ...] [ CASCADE | RESTRICT ] DESCRIPTION 描述 DROP SEQUENCE 从数据库中删除序列号生成 ...

  3. FastDFS和集中存储方式对比

    指标 FastDFS   NFS  集中存储设备如NetApp.NAS 线性扩容性  高  差  差 文件高并发访问性能 高 差  一般 文件访问方式 专有API POSIX  支持POSIX 硬件成 ...

  4. 122. Best Time to Buy and Sell Stock II@python

    Say you have an array for which the ith element is the price of a given stock on day i. Design an al ...

  5. mongdb查询数据并且返回数据条数

    var totall; var a = db.db("Magiccat").collection("jishi_content").find().count({ ...

  6. 洛谷 P4073 [WC2013]平面图

    #include<bits/stdc++.h> using namespace std; ; typedef long double LD; ; ); int dcmp(LD x){ret ...

  7. 项目:开发->测试->上线:流程规范

    1) 项目分析 2) 项目经理分工协作 程序就具体流程: 1: 按项目名称: 建git, 数据库, 线上测试虚拟机 2: 按项目经理分配的大的模块. 自行划分工作阶段 a: 划分为小的模块 b: 预估 ...

  8. python基础知识04-散列类型运算优先级和逻辑运算

    散列类型 1.集合 定义集合 se = {1,2,3,4} se = set()定义空集合 se = {1,3,5,7} se2 = {1,3,8,9} se & se2 {1,3} 交集 s ...

  9. day17-python之文件操作

    1.内置函数 #!/usr/bin/env python # -*- coding:utf-8 -*- # print(abs(-1)) # print(abs(1)) # # print(all([ ...

  10. [MVC]Area区域相关技术

    MVC提供Area机制,在同一个项目之内就能够切割出不同的ASP.NET MVC网站. 插入:首先在相同的位置,比如说同一个文件夹(如:Controllers)是不能创建俩个相同名称的文件(如:Hom ...