is this dynamic (column & table) PHP select query safe?
问题 Tables and Columns names cannot be bind using PDO ->bindParam(), but I am sure more than one would love to be able to. It is a little late, but I wrote this earlier and so far it works. I am kind of new to php, and would like to know what you think and if it is safe. $type = "defaultTableName"; $sortBy = "defaultColumnName"; $orderBy = "ASC"; //whitelisting unsafe input if(isset($_GET['orderBy'])&&($_GET['orderBy']=="ASC"||$_GET['orderBy']=="DESC")) $orderBy = $_GET['orderBy']; $tableNames =