note 85962 deleted from pdo.prepare by danbrown

Note Submitter: Anonymous ---- @ jacques at chester dot id dot au If your table names are configurable (and came from a safe source, like your own config), you can easily use string concatenation to put them in a query. If the source is unknown / unsafe, it's usually a sign of terrible design flaws. in example if you have N tables with the same set of fields, it would be much safer to make just two tables - mark (containing list of names of what "used to be" old tables) and real data (with one more column referencing key). Then, all operations on data can be performed using the db user unable to delete all your data, and (the point this all started) you know names of both tables when preparing statement, so no problem with PDO not converting/escaping it properly. Only exception is when you're writing DB management system. Then, however, user is supported to have access to everything db user has, so SQL Injection is a cese of no gain == no problem. As far as I understand, those were main reason nobody even thought that serious developer will need functioning table names sql injection prevention so near to db drivers.