PHP，MY SQL错误查询

Question

我有一个应用程序通过我的PHP变量（nomecardapioBD，它接收并记录在变量中：nomecardapioBD），这是我想要选择所有行和列的表名。

但是通过帖子接收变量无法进行预约。任何人都可以告诉我这部分代码出了什么问题？

$query = "Select * FROM :nomecardapioBD "; 

    $query_params = array(
     ':nomecardapioBD' => $_POST['nomecardapioBD'] 
    ); 

//execute query 
try { 
    $stmt = $db->prepare($query); 
    $result = $stmt->execute($query_params); 
} 
catch (PDOException $ex) { 
    $response["success"] = 0; 
    $response["message"] = "Database Error!"; 
    die(json_encode($response)); 
} 

// Finally, we can retrieve all of the found rows into an array using fetchAll 
$rows = $stmt->fetchAll(); 

Answer 1

表名和列名不能由PDO中的参数替换。只用它作为

$table=$_POST['nomecardapioBD']; 
$query = "Select * FROM $table"; 


//execute query 
try { 
    $stmt = $db->prepare($query); 
    $result = $stmt->execute(); 
} 
catch (PDOException $ex) { 
    $response["success"] = 0; 
    $response["message"] = "Database Error!"; 
    die(json_encode($response)); 
} 

Answer 2

为什么不这样做？

$query = "Select * FROM " . $_POST['nomecardapioBD']; 


//execute query 
try { 
    $stmt = $db->prepare($query); 
    $result = $stmt->execute(); 
} 
catch (PDOException $ex) { 
    $response["success"] = 0; 
    $response["message"] = "Database Error!"; 
    die(json_encode($response)); 
} 

// Finally, we can retrieve all of the found rows into an array using fetchAll 
$rows = $stmt->fetchAll(); 

你也应该做一些输入消毒。