KnowledgeHub
Questions
Tags
Users
Search
Alex Rivera
|
Logout
Edit Question
Title
Body
I was wondering if there was any way to specify returned column names using prepared statements. I am using MySQL and Java. When I try it: String columnNames="d,e,f"; //Actually from the user... String name = "some_table"; //From user... String query = "SELECT a,b,c,? FROM " + name + " WHERE d=?";//... stmt = conn.prepareStatement(query); stmt.setString(1, columnNames); stmt.setString(2, "x"); I get this type of statement (printing right before execution). SELECT a,b,c,'d,e,f' FROM some_table WHERE d='x' I would, however, like to see: SELECT a,b,c,d,e,f FROM some_table WHERE d='x' I know that I cannot do this for table names, as discussed here , but was wondering if there was some way to do it for column names. If there is not, then I will just have to try and make sure that I sanitize the input so it doesn't lead to SQL injection vulnerabilities.
Tags (comma-separated)
Save Edits
Cancel