note 95488 added to pdo.prepared-statements

You have to make attention to the parameters send to the method. We can imagine that a request like that can work: <?php $query = 'SELECT ? FROM ? WHERE id = ?'; ?> But in fact, it's a hijack of prepared query, which MUST be used *ONLY* to change the condition (here the last '?' ). You do not send my_table.my_row or my_scheme.my_table because this parameters are essentials to optimize the query before execution. Other thing: prepared query can not be serialized to reuse it some time later. For that you can use a mask (http://fr2.php.net/singleton) A prepared query is temporary. ---- Server IP: 195.221.21.36 Probable Submitter: 82.230.148.189 ---- Manual Page -- http://www.php.net/manual/en/pdo.prepared-statements.php Edit -- https://master.php.net/note/edit/95488 Del: integrated -- https://master.php.net/note/delete/95488/integrated Del: useless -- https://master.php.net/note/delete/95488/useless Del: bad code -- https://master.php.net/note/delete/95488/bad+code Del: spam -- https://master.php.net/note/delete/95488/spam Del: non-english -- https://master.php.net/note/delete/95488/non-english Del: in docs -- https://master.php.net/note/delete/95488/in+docs Del: other reasons-- https://master.php.net/note/delete/95488 Reject -- https://master.php.net/note/reject/95488 Search -- https://master.php.net/manage/user-notes.php