CODEWITHSUNDEEP
mysql
Michael St Clair
Michael St Clair

Reputation: 6625

Column not found: 1054 Unknown column ''1'' in 'field list'

I am trying to update columns that are numbered, however I am getting a warning that these columns do not exist, even though I do have a column 1 in TRIPLECROWNpicks

SQLSTATE[42S22]: Column not found: 1054 Unknown column ''1'' in 'field list'

$sql = "UPDATE TRIPLECROWNpicks SET `:pick` = :replace WHERE `user_id` = :user_id";
        $stmt = $dbh->prepare($sql);
        $stmt->bindValue(':user_id', $_POST['user_id'], PDO::PARAM_INT);
        $stmt->bindValue(':replace', $replace, PDO::PARAM_INT);
        $stmt->bindValue(':pick', $_POST['pick'], PDO::PARAM_INT);
        $stmt->execute();

Upvotes: 0

Views: 886

Answers (3)

Jānis Gruzis
Jānis Gruzis

Reputation: 995

You bind value here and claim it to be integer.

$stmt->bindValue(':pick', $_POST['pick'], PDO::PARAM_INT);

Then you use it here as column name

SET `:pick` = :replace

There are at least two things wrong here:

  1. Integer for column name is a bad idea.
  2. And you should not use parameters as columns names.

Upvotes: 0

Beri
Beri

Reputation: 11610

You cannot parametrize column names.

Either you concatenate update string (not preferable -there is possibility for SQL injection) or create a map of prepared statements, and use pick property as selector for them.

Upvotes: 0

juergen d
juergen d

Reputation: 204766

You cannot parametrize table or column names. Only values.

So if you want to use different columns then use completly seperate queries.

Upvotes: 1

Related Questions