php - Can I parameterize the table name in a prepared statement? -

i've used mysqli_stmt_bind_param function several times. however, if separate variables i'm trying protect against sql injection run errors.

here's code sample:

function insertrow( $db, $mysqli, $new_table, $partner, $merchant, $ips, $score, $category, $overall, $protocol ) {     $statement = $mysqli->prepare("insert " .$new_table . " values (?,?,?,?,?,?,?);");     mysqli_stmt_bind_param( $statment, 'sssisss', $partner, $merchant, $ips, $score, $category, $overall, $protocol );     $statement->execute(); } 

is possible somehow replace .$new_table. concatenation question mark statement, make bind parameter statement, or add onto existing 1 protect against sql injection?

like or form of this:

function insertrow( $db, $mysqli, $new_table, $partner, $merchant, $ips, $score, $category, $overall, $protocol ) {         $statement = $mysqli->prepare("insert (?) values (?,?,?,?,?,?,?);");     mysqli_stmt_bind_param( $statment, 'ssssisss', $new_table, $partner, $merchant, $ips, $score, $category, $overall, $protocol );     $statement->execute(); } 

short answer question "no".

in strictest sense, @ database level, prepared statements allow parameters bound "values" bits of sql statement.

one way of thinking of "things can substituted @ runtime execution of statement without altering meaning". table name(s) not 1 of runtime values, determines validity of sql statement (ie, column names valid) , changing @ execution time potentially alter whether sql statement valid.

at higher level, in database interfaces emulate prepared statement parameter substitution rather send prepared statements database, such pdo, conceivably allow use placeholder anywhere (since placeholder gets replaced before being sent database in systems), value of table placeholder string, , enclosed such within sql sent database, select * ? mytable param end sending select * 'mytable' database, invalid sql.

your best bet continue

select * {$mytable} 

but absolutely should have white-list of tables check against first if $mytable coming user input.