What is the best practice for using variables as table names in a SELECT query in PHP?

When using variables as table names in a SELECT query in PHP, it is important to properly sanitize the input to prevent SQL injection attacks. One way to do this is by using prepared statements with placeholders for the table name. This helps to separate the data from the query and ensures that the input is treated as data rather than executable code. 

// Assuming $tableName contains the table name provided by the user
$tableName = $_POST['tableName'];

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=your_database', 'username', 'password');

// Prepare a statement with a placeholder for the table name
$stmt = $pdo->prepare("SELECT * FROM $tableName");

// Execute the statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

// Loop through the results
foreach ($results as $row) {
    // Process each row as needed
}

Keywords

PHP variables table names SELECT query best practice

Related Questions