php - mysql prepared statement "truncate table ?" returns null -


in function truncate table can use

$stmt = $mysqli->prepare("truncate table packed_items"); 

and $stmt set mysqli_stmt object, but
if try

$stmt = $mysqli->prepare("truncate table ?"); 

then $stmt set null , statment:

$stmt->bind_param("s", $mytable) 

will crash error
call member function bind_param() on non-object in

i using parameterized prepared statements select,insert , update no problem.

you cannot bind sql literal data one. no keyword, no operator, no identifier.

if need truncate tables dynamically, knowing no name (as truncating tables @ random sign of bad design), check table name against white list, format correctly, , interpolate in query string.


Comments

Popular posts from this blog

curl - PHP fsockopen help required -

HTTP/1.0 407 Proxy Authentication Required PHP -

c# - Resource not found error -