Using a value to select table in PDO/DBH

[markman641]

Hi, I'm trying to use a PHP variable to select my table ($currentFile gets the folder the page is in) except i keep getting this error:

Fatal error: Call to a member function execute() on a non-object in /home/quizbona/public_html/campaigns/1/index.php on line 18

And yes, I'm positive it's the value causing it to mess up. it worked until I put that in there.

Neither of these work:

PHP Code:

<?
//the SQL we want to execute
$sql = 'SELECT * FROM ?';
//prepare the query
$sth = $dbh->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY));
//execute the query
$sth->execute(array($currentFile));
//fetch all rows
$words = $sth->fetchAll();
//print all rows
foreach($words as $word) {
?>
........

PHP Code:

<?
//the SQL we want to execute
$sql = 'SELECT * FROM $currentFile';
//prepare the query
$sth = $dbh->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY));
//execute the query
$sth->execute(array());
//fetch all rows
$words = $sth->fetchAll();
//print all rows
foreach($words as $word) {
?>
.....

[markman641]

I seem to have stumped everyone?

[alemcherry]

There is an error creating the object dear, you need to have proper error handling.

$sth = $dbh->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY))
      or die "Can't prepare SQL statement: $DBI::errstr\n";

will give you the reason.

[Fou-Lu]

^ this is correct for your actual error.
However, I don't believe you can bound any structure as a part of the statement. The table name would include the structure; statements are designed to separate the structure of the table with the data to go within the table, so you can bind when providing information to insert or query from for example, but not for table names or properties.

Your second one doesn't work as the table name probably isn't $currentFile. Variables are not parsed in single quotations.

[Keleth]

Yup, I can confirm that though it would be nice, you cannot prepare a table name. As PDO internally quotes or converts to a number or whatever it may be, when you try to add a table, it seems to treat it as a literal string, and a table name is not a literal string.

You'll either have to sanitize yourself and add it to the actual string before the prepare, or type it in. Given you should always know what the possible table names are, you can easily create an if series to test entered names against known names and only continue if there is a match.

[markman641]

Okay, for some reason this code isn't even working at all. It outputs nothing..

PHP Code:

<?php

//create the database object
$dbh = new PDO('mysql:host=localhost;dbname=xxxxxx', 'xxxx', 'xxxxx');

//the SQL we want to execute
$sql = 'SELECT * FROM 1 WHERE :all';

//prepare the query
$sth = $dbh->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY))
      or die ("Can't prepare SQL statement: $DBI::errstr\n");

//execute the query
$sth->execute(array(":all" => "1"));

//fetch all rows
$words = $sth->fetchAll();

//print all rows
foreach($words as $word) {
  echo $word[0];

}

?>

[Fou-Lu]

Works for me; I changed only the table name to something other than 1. That would indicate to me that you have no records in your table 1.

[markman641]

Originally Posted by Fou-Lu

Works for me; I changed only the table name to something other than 1. That would indicate to me that you have no records in your table 1.

weird.. I do.. let me try changing the table name

[markman641]

Originally Posted by Fou-Lu

Works for me; I changed only the table name to something other than 1. That would indicate to me that you have no records in your table 1.

well.. would you look at that. my table can't be called 1 for some reason 0.o
it works. thanks!