带有字符串插值的Prepared语句因语法错误而失败

Question

I'm trying to use prepared statements to do a simple insert with PHP and Postgres. So far, I've done this:

<?php
$conn_string = "host=localhost port=5432"; // plus us/pw
$dbconn = pg_connect($conn_string); 

$table  = 'business_primary_category';
$column = 'primary_category';
$tag = 'restuarant';


// Prepare a query for execution
$result = pg_prepare($dbconn, "my_query", 'SELECT * FROM $table WHERE $column = $1');

// Execute the prepared query.  Note that it is not necessary to escape
// the string "Joe's Widgets" in any way
$result = pg_execute($dbconn, "my_query", array("$tag"));

?>

I've taken it basically from the page on php.net, and can't figure out what I've done wrong. Do I need to install a library to use it or something. Thanks!

These are the errors I get:

Warning: pg_prepare() [function.pg-prepare]: Query failed: ERROR: syntax error at or near "$" at character 15 in /home/url    **......**   pdo.php on line 11

Warning: pg_execute() [function.pg-execute]: Query failed: ERROR: prepared statement "my_query" does not exist in /home/url    **......**   pdo.php on line 15

Warning: pg_execute() [function.pg-execute]: Query failed: ERROR: prepared statement "my_query" does not exist in /home/url    **......**   pdo.php on line 18

Answer 1

If you want your variables to be interpolated, then you need to use double quotes; else PHP treats it as a string literal. Try:

$result = pg_prepare($dbconn, "my_query", "SELECT * FROM $table WHERE $column = $1");