PHP, MY SQL error query [duplicate]

Question

I have an application that goes by that passes for my PHP a variable (nomecardapioBD and which received and recorded in the variable :nomecardapioBD) which is the table name that I want to select all rows and columns.

But to receive the variable via post can not make the appointment. Can anyone tell me what was wrong with this part of my code ?

$query = "Select * FROM :nomecardapioBD "; $query_params = array( ':nomecardapioBD' => $_POST['nomecardapioBD'] ); //execute query try { $stmt = $db->prepare($query); $result = $stmt->execute($query_params); } catch (PDOException $ex) { $response["success"] = 0; $response["message"] = "Database Error!"; die(json_encode($response)); } // Finally, we can retrieve all of the found rows into an array using fetchAll $rows = $stmt->fetchAll();

Table and Column names cannot be replaced by parameters in PDO. — Saty
– Saty, Commented May 31, 2016 at 7:13

Your Common Sense · Accepted Answer · 2016-06-01 11:27:06Z

3

Why not this?

$query = "Select * FROM " . $_POST['nomecardapioBD']; //execute query try { $stmt = $db->prepare($query); $result = $stmt->execute(); } catch (PDOException $ex) { $response["success"] = 0; $response["message"] = "Database Error!"; die(json_encode($response)); } // Finally, we can retrieve all of the found rows into an array using fetchAll $rows = $stmt->fetchAll();

You should also do some sort of input sanitization though.

edited Jun 1, 2016 at 11:27

Your Common Sense

158k42 gold badges226 silver badges373 bronze badges

answered May 31, 2016 at 7:15

hashbrown

3,5461 gold badge23 silver badges37 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

Your Common Sense Over a year ago

This answer is an SQL injection itself. Wonder why it was so much upvoted.

hashbrown Over a year ago

@YourCommonSense I didn't mean to provide an industry standard solution. I showed the OP a way to resolve his issue. And I made the last statement to suggest him against the danger.

Your Common Sense Over a year ago

You showed the wrong way.

Your Common Sense Over a year ago

I rolled back your edit because it made your answer even worse.

Your Common Sense Over a year ago

This question is already closed as a duplicate with a link to the answer with a proper solution. but if you are curious what was wrong with your edit, I'll explain that: you see, whatever escape_string function is essentially fro the strings only. While escaping an identifier wi th it will do no help and will not stop an injection, while giving you a false feeling of safety.

|

Saty · Accepted Answer · 2016-05-31 07:12:38Z

Table and Column names cannot be replaced by parameters in PDO. Just use it as

$table=$_POST['nomecardapioBD']; $query = "Select * FROM $table"; //execute query try { $stmt = $db->prepare($query); $result = $stmt->execute(); } catch (PDOException $ex) { $response["success"] = 0; $response["message"] = "Database Error!"; die(json_encode($response)); }

You should have been voted to close this question instead of posting an insecure answer that leads to SQL injection.

Collectives™ on Stack Overflow

PHP, MY SQL error query [duplicate]

2 Answers 2

7 Comments

1 Comment

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

7 Comments

1 Comment

Linked

Related