note 129987 added to pdo.prepare

As mentioned above, column and table identifiers cannot be passed as parameters in prepared queries. PDO also does not provide a method to escape and quote an identifier. The following method is what I use to escape and quote an identifier. Note that $this->pdo is a PDO object. <?php /** * Escape and quote an identifier. * * @param string $identifier Column or table name to escape and quote * @param string $quoteWith Database dependent, default backtick * @return string */ public function quoteIdentifier( string $identifier, $quoteWith = '`' ) : string { $s = $this->pdo->quote( $identifier ) ; // escaped and quoted $s = trim( $s, $s[0] ) ; // remove the quotes, assumes open and closing the same $s = $quoteWith . $s . $quoteWith ; // add new quote return $s ; } ?> ---- Server IP: 45.112.84.4 Probable Submitter: 80.90.5.137 (proxied: 111.220.212.23) ---- Manual Page -- https://php.net/manual/en/pdo.prepare.php Edit -- https://main.php.net/note/edit/129987 Del: integrated -- https://main.php.net/note/delete/129987/integrated Del: useless -- https://main.php.net/note/delete/129987/useless Del: bad code -- https://main.php.net/note/delete/129987/bad+code Del: spam -- https://main.php.net/note/delete/129987/spam Del: non-english -- https://main.php.net/note/delete/129987/non-english Del: in docs -- https://main.php.net/note/delete/129987/in+docs Del: other reasons-- https://main.php.net/note/delete/129987 Reject -- https://main.php.net/note/reject/129987 Search -- https://main.php.net/manage/user-notes.php