PHP PDO引发致命错误1064

Question

I'm learning about PDO and prepared statements and have run into a problem. I keep getting this error:

Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error
or access violation: 1064 You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use near ''Users' WHERE
Username = 'yayu'' at line 1' in /home/u230594705/public_html/pages/panel.php:33 Stack
trace:#0 /home/u230594705/public_html/pages/panel.php(33): PDOStatement->execute(Array) #1 
{main} thrown in /home/u230594705/public_html/pages/panel.php on line 33

with this code:

session_start();

$user = $_SESSION["user"];
$table = "Users";

//Establish Connection
$dsn = "mysql:host=$dbHost;dbname=$dbName;charset=utf8";
$opt = array(
        PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
        );
$pdo = new PDO($dsn,$dbUser,$dbPass, $opt);

//Prepare query to execute
$stmt = $pdo->prepare("SELECT Username, Password, Email FROM ? WHERE Username = ?");

$stmt->execute(array($table, $user));
$row = $stmt->fetch();

//Check
echo $row['Username'];

Any help would be appreciated!

Answer 1

You cannot specify parameter for table name and column names.

Change your $stmt like follows:

$stmt = $pdo->prepare("SELECT Username, Password, Email FROM $table WHERE Username = ?");

And your execute as follows:

$stmt->execute(array($user));

Here is a good explanation why you cannot specify parameter for table names or column names: http://www.php.net/manual/en/pdo.prepare.php#111977