PHP，MY SQL錯誤查詢

Question

我有一個應用程序通過我的PHP變量（nomecardapioBD，它接收並記錄在變量中：nomecardapioBD），這是我想要選擇所有行和列的表名。

但是通過帖子接收變量無法進行預約。任何人都可以告訴我這部分代碼出了什麼問題？

$query = "Select * FROM :nomecardapioBD "; 

    $query_params = array(
     ':nomecardapioBD' => $_POST['nomecardapioBD'] 
    ); 

//execute query 
try { 
    $stmt = $db->prepare($query); 
    $result = $stmt->execute($query_params); 
} 
catch (PDOException $ex) { 
    $response["success"] = 0; 
    $response["message"] = "Database Error!"; 
    die(json_encode($response)); 
} 

// Finally, we can retrieve all of the found rows into an array using fetchAll 
$rows = $stmt->fetchAll(); 

Answer 1

表名和列名不能由PDO中的參數替換。只用它作爲

$table=$_POST['nomecardapioBD']; 
$query = "Select * FROM $table"; 


//execute query 
try { 
    $stmt = $db->prepare($query); 
    $result = $stmt->execute(); 
} 
catch (PDOException $ex) { 
    $response["success"] = 0; 
    $response["message"] = "Database Error!"; 
    die(json_encode($response)); 
} 

Answer 2

爲什麼不這樣做？

$query = "Select * FROM " . $_POST['nomecardapioBD']; 


//execute query 
try { 
    $stmt = $db->prepare($query); 
    $result = $stmt->execute(); 
} 
catch (PDOException $ex) { 
    $response["success"] = 0; 
    $response["message"] = "Database Error!"; 
    die(json_encode($response)); 
} 

// Finally, we can retrieve all of the found rows into an array using fetchAll 
$rows = $stmt->fetchAll(); 

你也應該做一些輸入消毒。