php - what's wrong with this single PDO? -
here thing, other pdo works well, 1 doesn't. have tried
execute(array(':t'=>$table));
with no success. ideas?.
public function __construct($table){ try{ $pdocnx = new pdo("mysql:host=localhost;dbname=sigcat",'root',''); $stmt = $pdocnx->prepare('select * sigcat.:t'); $stmt->bindparam(':t', urldecode($table), pdo::param_str,45); $stmt->execute(); $row = $stmt->fetchall(pdo::fetch_assoc); var_dump($row); }catch(exception $e){ echo $e->getmessage(); } }
i got many records in 'supplies' returns array(0) { }. i'm getting 'table' parameter $_get['table']. no exceptions though.
you can't bind table names, values.
maintain list of valid names , ensure string present in valid list.
if can't build list of valid names, doing wrong.
Comments
Post a Comment