java - Is it possible to supply parameters for table or column name in Prepared Statements or QueryRunner.update()?

Question

DELETE from ? WHERE ? = ?

Is it possible to feed in parameters for all of these ?s? It seems that if I don't supply Strings, I get errors. For example, it only seems to work if I have something like:

DELETE from nonprofit WHERE nonpid = ?

It only takes parameters like this.

Answer 1

The answer is no you can not use table names in the prepared statements. The prepared statements will only work for column values.

This usually can be circumvented with an alternate schema, but if you really need to you can always build the optional Table name into the query by modifying the query string. If you do so make sure to sanitize your input to prevent sql injection.