1

It's a little relative to the question I asked here (PDO adds the apostrophe to the mySQL query) but this time column name is a parameter.

Not working PDO example would be like this:

"UPDATE tbl SET :COL1 = NOT :COL1;"

sure solution like this:

"UPDATE tbl SET $COL1 = NOT $COL1;" // works (but it's not PDO)

but why

"UPDATE tbl SET $COL1 = NOT :COL1;" // does not ??

while

"UPDATE tbl SET $COL1 = :VAL_COL1;" // is ok if I first get and negate COL1 value...
1
  • If you are looking to dynamically call column (or even table) names and are trying to use PDO as a protection against SQL injection, you could always use a PDO statement against the information schema tables to verify the column name, and use that result in a concatenated querystring
    – WebChemist
    Jan 16, 2015 at 23:55

2 Answers 2

1

In a prepared statement, a parameter is a constant value that will be passed into the query without affecting how the query will be run. This allows the database to "prepare" the query ahead of time and figure out how it will be executed even without knowing the exact values that will be used.

Using this definition, a query like this does not have any parameters, and so the PDO and non-PDO versions of the query will look the same. Your working (first) example is as good as you're going to get. In fact, I'd claim that your first example actually is the PDO version.

To use a non-database example, a prepared statement is very much like a function in a programming language such as PHP. A function accepts parameters and uses their values, but (in normal circumstances) the parameters are not lines of code that will be run. The same code is run regardless of what the parameter values are - the function code itself is not changed by the parameters.

2
  • It seems to me that the value passed after " = " is a parameter. It could be a constant like "asfdasdf" or, as in my case, the opposite value of the same column.
    – Paul Paku
    Jan 16, 2015 at 23:12
  • and I think that's it :)
    – Paul Paku
    Jan 16, 2015 at 23:28
0

No. You cannot bind table names or column names as parameters. You can only bind values as parameters.

See more here: Can PHP PDO Statements accept the table or column name as parameter?

Not the answer you're looking for? Browse other questions tagged or ask your own question.