PDO中的“SELECT：parameter FROM ..”[复制]

Question

This question already has an answer here:

• Can PHP PDO Statements accept the table or column name as parameter? 7 answers

I'm trying to select a variable column name in my table, but this doesn't seem to work:

$reponse = $bdd->prepare('SELECT :day AS day FROM TABLE WHERE id= :id');               
$reponse->execute(array('day' => 'monday', 'id' => '5')); 
$day = $reponse->fetch();

Even by setting 'day', to a sure known element in my table (monday), it doesn't work. Same for id.

Does someone know how to fix that?

I have no php error output, only a mysql query error (that doesn't show). By replacing ':day' by monday, I have an output.

</div>

Answer 1

Due to the order in which the SQL is parsed, there's simply no way to use a bound parameter as part of the SQL statement (for example, a column or table name).

Instead, you'll need to build the string with string concatenation. If the value of :day comes from an external source (database, POST parameter, etc), to avoid possible SQL injection attacks you'll want to validate the input to make sure it's a valid column or expression.