how to remove quotes of any string when preparing queries

mysql, pdo, php, quotes

Solution

You would have to use literal strings I'm afraid, because placeholders can't contain keywords such as those for sorting order (amongst others):

$query = sprintf('SELECT * FROM `courses` ORDER BY `id` %s LIMIT :limitInc, :limit ', 
    strcasecmp($desc, 'DESC') === 0 ? 'DESC' : 'ASC')
);
$getRecords = $conn->prepare($query);

Building the query this way isn't so bad, because there are only two options.

Problem

``` $desc = 'DESC'; $getRecords = $conn->prepare('SELECT * FROM `courses` ORDER BY `id` :sort LIMIT :limitInc, :limit '); $getRecords->bindValue(':limit',$limit,PDO::PARAM_INT); // working $getRecords->bindValue(':limitInc',$limitInc,PDO::PARAM_INT); // working // *** The line below isn't working *** $getRecords->bindValue(':sort', $desc ,PDO::PARAM_STR); // not working $getRecords->execute(); ``` I am trying to call `$desc` in my prepare query.. Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''DESC' LIMIT 0, 5' at line 1' in C:\xampp\htdocs\portfolio\nasiraan\try\indexx.php:89 Stack trace: #0 C:\xampp\htdocs\portfolio\nasiraan\try\indexx.php(89): PDOStatement->execute() #1 {main} thrown in C:\xampp\htdocs\portfolio\nasiraan\try\indexx.php on line 89 i am sure the solution is.. to remove quotes from the string `$desc`... but how ??

Original source