Question: I want to bind sysdate function in my PDO prepared query :

```
$db = new PDO('oci:dbname=database;charset=UTF8', 'user', 'pass');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

$query = $db->prepare('SELECT :func FROM DUAL');
$query->execute(array(':func' => 'SYSDATE()'));
var_dump($query->fetch());

```

The result return this : 

```
array (size=2)
  ':FUNC' => string 'SYSDATE()' (length=9)
  0 => string 'SYSDATE()' (length=9)

```

I want to get the system date of my oracle database. Is it possible ?

Can you help me to make my trick ?

Answer: 
Your example, *and* the provided answer "that works" is vulnerable to [SQL injection attacks](https://www.owasp.org/index.php/SQL_Injection). *Please* read up on this dangerous practice. I am therefore suggesting you do not use it. 

You want to use a [`PreparedStatement`](http://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html) for column fields. Please read up on the importance of prepared statements, as it will prepare you for a better future in programming more secure solutions.

---

Allowing the user to input the Table Name is *not* a good idea
--------------------------------------------------------------

Not only is this not a good idea, it's not even supported by `PreparedStatement`. 

You cannot use a table name as parameter (`?`) in the prepared statements. You'll have to find another way to put it there, such as string concatenation, which is dangerous. 

Unless you're using a pre-determined white-list, you *cannot* allow the table name to be chosen by the user, though, as that would allow SQL injection.

Credentials in repositories is another security risk.

You should also avoid putting the username and password directly into `getConnection()`. Use a secret manager or, at the very least, read from a properties file (bonus points if encrypted with a secret manager) that doesn't get committed to the repository. 

Here's your fixed try block:

```
try
{
    Connection con = DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:oracle12c", username, password);

    // You want to prepare a statement so you can pass parameters.
    PreparedStatement stmt = con.prepareStatement();

    // The first question mark (?)
    // Assuming this is an INT type. If not, there is setString, setLong, etc.
    ps.setInt(1, id);

    // Note the first question mark is where the ID is supposed to be. This is a parameter.
    ResultSet rs = stmt.executeQuery("select * from tableName where id = ?");

    while (rs.next())
    {
        // Replace "column_name" with the name of your column
        System.out.println(rs.getString("column_name"));
    }

    con.close();
    stmt.close();
}

```

If you are learning to code, whomever is telling you to do it the way you're doing it, is setting you up for a lifetime of very bad coding practices, which will lead to the companies you work for being hacked.
Change `"select * from "+tableName+"where id='"+id+"'"` to `"select * from " + tableName + " where id='" + id + "'"`

Notice the space before where clause.