title: Hack prepare statement (read first)
body: <p>I have this code:</p>
  
  <pre><code>&lt;?php
  $table = $_GET ["table"];
  $query = "SELECT 1 FROM $table";
  $st = $pdo-&gt;prepare($query);
  $st-&gt;execute();
  </code></pre>
  
  <p>This is not the real code, but it is an example to get the idea.</p>
  
  <p>If I make:</p>
  
  <pre><code>hacked.php?table=users;DROP TABLE users;
  </code></pre>
  
  <p>It will work, cause it is not correctly escaped.</p>
  
  <p>However, if I want to update information like this:</p>
  
  <pre><code>hacked.php?table=users; UPDATE users SET name="abc" WHERE name="def";
  </code></pre>
  
  <p>It will not work, cause since it is escaped, pdo will convert the query to </p>
  
  <pre><code>SELECT 1 FROM users; UPDATE users SET name=\"abc\" WHERE name=\"def\";
  </code></pre>
  
  <p>and obviously it fails. </p>
  
  <p>Is there anyway to make this query works?</p>
  
  <p><strong>EDIT 1</strong></p>
  
  <p>We have one guy in our team only devoted to check my code and hacked it. So I want to be ready if this can be in some way accomplished.</p>
  
  <p><strong>EDIT 2</strong></p>
  
  <p>I was already read this: <a href="https://stackoverflow.com/questions/134099/are-pdo-prepared-statements-sufficient-to-prevent-sql-injection?rq=1">Are PDO prepared statements sufficient to prevent SQL injection?</a> but it really did not answered my question. However it gave me a way to go through. And the solution of @duskwuff was the same I came to. So, for the admins, if this should be removed or marked as a duplicate is ok. But I insist that this can be helpful for someone to know how pdo prepared can be hacked. </p>