Can PHP PDO Statements accept the table or column name as parameter?

May 21, 2022 by IT Nursery

Why can’t I pass the table name to a prepared PDO statement?

$stmt = $dbh->prepare('SELECT * FROM :table WHERE 1');
if ($stmt->execute(array(':table' => 'users'))) {
    var_dump($stmt->fetchAll());
}

Is there another safe way to insert a table name into a SQL query? With safe, I mean that I don’t want to do

$sql = "SELECT * FROM $table WHERE 1"

8 Answers
8