Is it possible to supply parameters for table or column name in Prepared Statements or QueryRunner.update()?

前端 未结 1 1211
爱一瞬间的悲伤
爱一瞬间的悲伤 2020-12-04 03:23

DELETE from ? WHERE ? = ?

Is it possible to feed in parameters for all of these ?s? It seems that if I don\'t supply Strings, I get errors. For example, it only seem

相关标签:
1条回答
  • 2020-12-04 04:05

    The answer is no you can not use table names in the prepared statements. The prepared statements will only work for column values.

    This usually can be circumvented with an alternate schema, but if you really need to you can always build the optional Table name into the query by modifying the query string. If you do so make sure to sanitize your input to prevent sql injection.

    0 讨论(0)
提交回复
热议问题