php的mysql_prepare不能使用表明一類級作為參數

標籤：php mysql

No, a parameterised query doesn‘t just drop the parameter values in to the query string, it supplies the RDBMS with the parameterised query and the parameters separately. But such a query can‘t have a table name or field name as a parameter. The only way to do that is to dynamically code the table name into the query string, just as you have already done. If this string is potentially open to attack you should validate it first; such as against a white list list of allowable table

php的mysql_prepare不能使用表明一類級作為參數