Prepared Statements: Possible to pass table or fieldnames as parameters?

Bjom

Hi there,

is it possible to pass the fieldname of a prep stmt as a parameter at all?

I almost expect that it is not - would counteract the idea of the PS, wouldn't it?

But it would be sooo helpful on the other hand. So:

Can it be done, or is there any other nice way?

The root of the problem is that I want to write data to a DB from an array where I have all the fieldnames as keys and values as...errm values. Just passing both as parameters would seem highly efficient and comfortable.

regards

Bjom

Weedpacket

No, because the DBMS can't construct a query execution plan without knowing what tables and fields are used.

In a way, it shouldn't be "sooo helpful" unless there was something wrong with the design of the database in the first place 🙂.

Bjom

For example when I got a big fat array returned from POSTing a dynamically created form.....and have all field names in the keys....it would be handy to just pass fieldname and value, instead of dynamically creating an SQL string in PHP that fits my needs. Nothing in my DB architecture can save me from that, I believe.

Bjom

laserlight

Bjom wrote:
For example when I got a big fat array returned from POSTing a dynamically created form.....and have all field names in the keys....it would be handy to just pass fieldname and value, instead of dynamically creating an SQL string in PHP that fits my needs. Nothing in my DB architecture can save me from that, I believe.

hmm... but since user input cannot be trusted, you would still need to check that the column names actually exist in the given table.

Bjom

Ok...the names come from some sort of CMS...that actually should be considered as user-input, true.

A check on every field seems expensive - the worst that can happen there is that a write runs into a non-existent field. Then what? Data is lost. So if someone messes up the DB, then the whole app is screwed up... hmmm.

Error message or check for fields' existence....

I'll investigate. Good point again. Ty

Bjom