http://www.perlmonks.org?node_id=1038136


in reply to DBI order by clause and placeholders

It's got nothing to do with Perl, though.

In general, the only places you're allowed to have placeholders are places where you'd have column values. This does not include table names and column names.

Assuming a table "blah" with columns "foo", "bar", "baz", you can't do the following either:

my $sth = $dbh->prepare('SELECT foo, bar, baz FROM ? WHERE ...'); $sth->execute('blah');

You'll have to fall back to building queries by string manipulation, if you really really need dynamic table names.

You can do this but it won't return what you expect:

my $sth = $dbh->prepare('SELECT foo, bar, ? FROM blah WHERE foo = 1 AN +D bar = 2'); $sth->execute('baz');

It'll just fetch 1, 2, and the literal string "baz". Consult your database server's documentation for more information.

The MySQL doc in particular says:

Within the statement, ? characters can be used as parameter markers to indicate where data values are to be bound to the query later when you execute it. The ? characters should not be enclosed within quotation marks, even if you intend to bind them to string values. Parameter markers can be used only where data values should appear, not for SQL keywords, identifiers, and so forth.