PDO不会更新到MySQL

Question

I'm trying to update the value of a field in MySQL with PDO, i've tried with the different types of prepared statements but none of them worked. Here is my code:

    $table = $_POST['table'];
    $field = $_POST['field'];
    $value = $_POST['value'];

    try{

       $available = "Available";
       $cero = 0;

       $q = "UPDATE ? SET $available = $cero WHERE ? = ? ";
       $stmt = $connection->getPdo()->prepare($q);  
       $stmt->execute( array ($table,$field,$value) );

       echo true;       

    }catch(PDOException $exception){
      echo $exception;
    }

Problem Solved:

   $q = "UPDATE $table SET $available = $cero WHERE $field = ? ";
   $stmt = $connection->getPdo()->prepare($q);  
   $stmt->execute( array ($value) );

Answer 1

You can't use ? to substitute a table name, or indeed any object name (columns, databases etc) in a prepared query. Parameterisation only works for values. You will have to do:

$q = "UPDATE $table SET $available = $cero WHERE $field = ? ";
$stmt = $connection->getPdo()->prepare($q);  
$stmt->execute( array ($value) );

The very fact that you tried to do this suggests that you are getting the table name from user input, which is a very bad idea, even if you are escaping it.