Android Question PDO PHP Select

aeric

Expert

Licensed User

Longtime User

• Jul 5, 2020

• #2

You can use prepare statement and pass the value to a parameter.

fernando.oliboni said:

I've tried it all the way using sprintf and concatenations and stuff and I haven't been successful

Click to expand...

Can you show how your write your code?

 

Last edited: Jul 5, 2020

Upvote 0

F

fernando.oliboni

Active Member

Licensed User

Longtime User

• Jul 5, 2020

• #3

B4X:

   $nome = $_GET["nome"];
   $nome =  "%" . $nome . "%";
   $banco_cliente = $_GET["banco_cliente"];

    $select = sprintf( "select * from %s ", $banco_cliente , " where nome like :nome");

    $select = $pdo->prepare($select);
    
    $select-> bindValue(":nome", $nome);
    $select-> execute();

 

Upvote 0

F

fernando.oliboni

Active Member

Licensed User

Longtime User

• Jul 5, 2020

• #4

Can PHP PDO Statements accept the table or column name as parameter?

Why can't I pass the table name to a prepared PDO statement? $stmt = $dbh->prepare('SELECT * FROM :table WHERE 1'); if ($stmt->execute(array(':table' => 'users'))) { var_dump($stmt->

stackoverflow.com

Table and Column names CANNOT be replaced by parameters in PDO.

 

Upvote 0

aeric

Expert

Licensed User

Longtime User

• Jul 6, 2020

• #5

try

PHP:

$select=“SELECT * FROM “.$banco_clientele.” WHERE nome LIKE :nome”;
$db = $pdo->prepare($select);
$db-> bindValue(":nome", “%”.$nome.”%”);
$db-> execute();

 

Upvote 0

Douglas Farias

Expert

Licensed User

Longtime User

• Jul 6, 2020

• #6

just a note, be careful with sql injection.

SQL:

select * from INFORMATION_SCHEMA.TABLES; DROP TABLE xxxxx;

you must treat the $_GET["banco_cliente"]; before using it directly in the query.

?

 

Last edited: Jul 6, 2020

Upvote 0