php - 调用 bool 值上的成员函数bind_param()，使用占位符时函数prepare()返回false

Question

这个问题已经有答案了:

Can I parameterize the table name in a prepared statement? [duplicate] (2 个回答)

已关闭 6 年前。

我尝试在 php 中准备 sql (mysqli) 语句，但出现上面写的错误代码。这是我写的代码:

 if (!$this->isUserExist($username, $token)) {return false;}
    $tables = array();        
    $tables[0] = "faculty";     
    $tables[1] = "department";  
    $tables[2] = "teacher";     
    $tables[3] = "announcement";
    $ttable = $tables[$table];
    var_dump($ttable); // faculty
    var_dump($id);     // 6
    echo "DELETE FROM ".$ttable." WHERE ".$ttable.".id = ".$id.""; //returns DELETE FROM faculty WHERE faculty.id = 6
    $stmt = $this->con->prepare("DELETE FROM ? WHERE ?.id = ?"); //Fatal error occurs here
    $stmt->bind_param("sss",$ttable,$ttable,$id);
    //$stmt->execute();
    if ($stmt->num_rows> 0) {
        return "true";
    } else {
        return "false";
    }

但是，如果我插入 echo my 中显示的不带任何占位符的精确语句，则不会出现错误，并且 MySQL 数据库成功删除行。

$stmt = $this->con->prepare("DELETE FROM faculty WHERE faculty.id = 6"); //no errors occur, executing this statement does affect row in MySQL database

Answer 1

系统不允许“准备”表名，你应该这样做

$stmt = $this->con->prepare("DELETE FROM ".$ttable." WHERE ".$ttable.".id = ?"); //Fatal error occurs here
$stmt->bind_param("s",$id);