mysql - How to SELECT all columns FROM table LIKE ?, where user selects values -

i'm trying set html pg display 'snp' table db. i've gotten , running nicely, wanted add in feature instead of:

my $sql = "select * snp cid ? order pos limit 10"; 

i allows user type in keyword , pull out proper table. thought do:

sub get_snp{     $sql = "select * snp ? ? order pos limit 10";     $snp_sth = $dbh->prepare($sql);     $snp_sth->execute("$user_select","%$search_string%"); 

to more clear, code worked $search_string not when adding in $user_select after. here parameters:

my $search_string = param("search_for"); $user_select = param("columns"); 

and both parameters later called in html portion follows:

<tr bgcolor="#c0c0c0">            <td><input type="text" name="search_for"                 style="color:#787878;"                 value="enter keyword | select option"            </td>             <select name="columns">              <option selected> --select option--</option>              <option value ="cid"> cid</option>              <option value ="pos"> position #</option>              <option value ="cdspos"> cds position</option>              <option value ="m82base"> m82 base</option>              <option value ="il"> introgression line</option>              <option value ="ilbase"> il base</option>              <option value ="snptype"> snp type</option>              <option value ="aachange"> snp</option>             </select>            <td><input type="submit" value="search"></td>            <td><input type="reset" value="reset"></td>          </tr> 

so above can see set droplist 8 different selections 8 different tables. again if user types in sl2.40ch12 , selects chromosome id (or cid) want data displayed, or if type in il10-1 , select introgression line (or il), data should pulled.

i may not going in right way suggestions helpful! let me know if more code or general information required :)

bound parameters (the ? doohikey) work parameter values, not table names or column names.

if want use variable table or column name, then:

• validate it (make sure valid table, or valid column, in db)

• interpolate sql string using regular interpolation:

  my $sql = qq[select * snp $my_col ? order pos limit 10];