note 111458 added to pdo.prepare

Hi All, First time posting to php.net, a little nervous. After a bunch of searching I've learned 2 things about prepared statements: 1.) It fails if you enclose in a single quote (') This fails: "SELECT * FROM users WHERE email=':email'" This works: "SELECT * FROM users WHERE email=:email" 2.) You cannot search with a prepared statement This fails: "SELECT * FROM users WHERE :search=:email" This succeeds: "SELECT * FROM users WHERE $search=:email" In my case I allow the user to enter their username or email, determine which they've entered and set $search to "username" or "email". As this value is not entered by the user there is no potential for SQL injection and thus safe to use as I have done. Hope that saves someone else from a lot of searching. ---- Server IP: 69.147.83.199 Probable Submitter: 108.180.210.129 ---- Manual Page -- http://php.net/manual/en/pdo.prepare.php Edit -- https://master.php.net/note/edit/111458 Del: integrated -- https://master.php.net/note/delete/111458/integrated Del: useless -- https://master.php.net/note/delete/111458/useless Del: bad code -- https://master.php.net/note/delete/111458/bad+code Del: spam -- https://master.php.net/note/delete/111458/spam Del: non-english -- https://master.php.net/note/delete/111458/non-english Del: in docs -- https://master.php.net/note/delete/111458/in+docs Del: other reasons-- https://master.php.net/note/delete/111458 Reject -- https://master.php.net/note/reject/111458 Search -- https://master.php.net/manage/user-notes.php