PHP Mysql_prepare cannot be used to indicate a class of parameters

No, a parameterised query doesn ' t just drop the parameter values in to the query string, it supplies the RDBMS with the PA rameterised query and the parameters separately. But such a query can ' t has a table name or field name as a parameter. The only-to-do-is-dynamically code the table name into the query string, just as you had already done. If This string was potentially open to attack you should validate it first; such as against a white list List of allowable table

PHP Mysql_prepare cannot be used to indicate a class of parameters