escaping column name with PDO

前端 未结 3 1459
温柔的废话
温柔的废话 2020-12-03 15:24

I have a function that\'s like

function getInfoById($id, $info) {

}

the idea is to have a query be \"SELECT $info FROM table WHERE i

3条回答
  •  一整个雨季
    2020-12-03 16:07

    What about using quote and substr.

    $sql = 'SELECT * FROM table WHERE `' . substr($db->quote($field), 1, -1) . '` = :id';
    

    This will remove the quotes surrounding the escaped field.

提交回复
热议问题