Question

It seems to me that this cose is ok with a standard query, but not when it comes to DESCRIBE:

$q = $dbh->prepare("DESCRIBE ?");
$q->execute(array($this->ormTable));
$table_fields = $q->fetchAll(PDO::FETCH_ASSOC);

Anyone can confirm? Are there workarounds other than appending manually the table name?

Answer 1

Be sure ormTable can’t be influenced from outside (SQL injection, etc) or quoted properly for syntax usage (do not use PDO::quote() for that)

$q = $dbh->prepare("DESCRIBE ".$this->ormTable);
$q->execute();
$table_fields = $q->fetchAll(PDO::FETCH_ASSOC);