php - mysql prepared statement "truncate table ?" returns null -
in function truncate table can use
$stmt = $mysqli->prepare("truncate table packed_items");
and $stmt set mysqli_stmt object, but
if try
$stmt = $mysqli->prepare("truncate table ?");
then $stmt set null , statment:
$stmt->bind_param("s", $mytable)
will crash error
call member function bind_param() on non-object in
i using parameterized prepared statements select,insert , update no problem.
you cannot bind sql literal data one. no keyword, no operator, no identifier.
if need truncate tables dynamically, knowing no name (as truncating tables @ random sign of bad design), check table name against white list, format correctly, , interpolate in query string.
Comments
Post a Comment