array inside of execute fails

Question

Why this one works

    class xyz{
    private $_db;
            function __construct(){

        //database connection 
    }

    function abc($login,$pass,$email){
        $l = "login";
        $check = $this->_db->prepare("SELECT userid FROM users WHERE login = ?");
        $check->execute(array($login));
        $res1 = $check->fetch(PDO::FETCH_NUM);
        return var_dump($res1);
    }
}

And if i change the row selection for login to the variable the code return bool false

    class xyz{
    private $_db;
    function __construct(){

        //database connection 
    }

    function abc($login,$pass,$email){
        $l = "login";
        $check = $this->_db->prepare("SELECT userid FROM users WHERE ? = ?");
        $check->execute(array($l,$login));<<<<<-----THIS $l FAILS TO WORK
        $res1 = $check->fetch(PDO::FETCH_NUM);
        return var_dump($res1);
    }
}

What is the best way to do 3 exactly same queries with different row selections and their values?

Why would you want to pass the column name, it will treat is as a string : "SELECT userid FROM users WHERE 'login' = 'whatever'" — ka_lin
– ka_lin, Commented Mar 1, 2013 at 11:23
Because I want to check 2 colomns and I've thought maybe it would be better to use same prepeared query for them. Now I see That I have to chose other way to do it. I didn't know that effect of this statment would be "SELECT userid FROM users WHERE 'login' = 'whatever'" — user2062756
– user2062756, Commented Mar 1, 2013 at 11:47

Community · Accepted Answer · 2023-11-17 20:42:18Z

2

You cannot parametrise column names in prepared statements: https://www.php.net/manual/en/book.pdo.php#69304

More also here: Which tokens can be parameterized in PDO prepared statements?

edited Nov 17, 2023 at 20:42

CommunityBot

11 silver badge

answered Mar 1, 2013 at 11:23

Bart Friederichs

33.8k16 gold badges112 silver badges219 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2017-05-23 12:03:21Z

1

Read tag wiki before asking a question.
Among other things there is said "placeholder cannot represent an arbitrary part of the query, but a complete data literal only."
Identifiers have to be formatted and white-listed instead of parameterization. You can see an example in a tag wiki.
the best way to to do 3 exactly same queries with different row selections and their values is to run one query, setting all the conditions into it.

edited May 23, 2017 at 12:03

CommunityBot

11 silver badge

answered Mar 1, 2013 at 11:25

Your Common Sense

158k42 gold badges226 silver badges373 bronze badges

1 Comment

user2062756 Over a year ago

Thank you for your answer. I thought about a simmular issues but didn't find anything usefull. I'll recheck this link.

Collectives™ on Stack Overflow

array inside of execute fails

2 Answers 2

Comments

1 Comment

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Linked

Related