mysqli prepared statements help

[ccirish]

Try though I might I cannot find a solution to this problem. When replacing ? with an actual value it works fine. Why can't I get bind_param to work with this? What am I doing wrong? 

 

Thanks.

<?php
//Config Settings
 $mysqli = new mysqli("localhost", "a", "b", "c");
 $TeamID = $_GET["TeamID"];

//Check that we have a DB
 if (!$mysqli)
 {
        printf("Connect failed: %s\n", mysqli_connect_error);
        exit();
 }

//StartHTML
 header("Content-Type: application/xml; charset=ISO-8859-1");
 echo '<?xml version="1.0" encoding="ISO-8859-1" ?>
 <rss version="2.0">
 <channel>
 <title>Title</title>
 <link>Link</link>
 <description>Description</description>';

//Pull Data
 $stmt = $mysqli->stmt_init();
 if ($stmt = $mysqli->prepare("SELECT title, link, description FROM ( ? )"))
 {
        $stmt->bind_param('s', $TeamID);
        $stmt->execute();
        $stmt->fetch();
        $stmt->bind_result($title, $link, $description);
 }
 else
 {
        echo $mysqli->error;
 }

//Loop Through Data
 while ($stmt->fetch())
 {
        echo '<item>
        <title>'.$title.'</title>
        <link>'.$link.'</link>
        <description>'.$description.'</description>
        </item>';
 }

//Shut this bitch down
 $stmt->close();
 $mysqli->close();
 echo '</channel></rss>';
?>

[Barand]

So are you saying that if the team id is 1 then this query works?

SELECT title, link, description FROM ( 1 )

[ccirish]

Well the parentheses are extra, I added them in while I was trying various things and it wouldn't let me edit them out, but yes, if the table is named 1 it would work.

 

Thanks

[Barand]

So you have a separate table for each team where the table name is the team id?

[ccirish]

Correct!

[Barand]

ROFL

[Barand]

But in answer to your question, you cannot assign table or column names to parameters in a prepared statement, you can only supply column values.

[ccirish]

Wow. Ok. Well that would explain why it doesn't work. Is there a way to prevent injection with what I am trying to do?

[Barand]

Put your team data in a single table, say "teams", with each row containing the team_id.. Then

 

SELECT .... FROM teams WHERE team_id = ?

[ccirish]

Excellence! Thanks so much!