title: Prepared statements and Escaping
body: <p>I've read many times over - and just want to clarify (I think I'm confused)</p>
  
  <p>I switched to mysqli today, and started using prepared statements.</p>
  
  <p><em>Example of my prepared statement</em></p>
  
  <pre><code>function read($table, $var) {
      if($stmt = mysqli_prepare($link, "SELECT * FROM ? WHERE `uid`=?")) {
          mysqli_stmt_bind_param($stmt, "si", $table, $var);
          mysqli_stmt_execute($stmt);
          return mysqli_fetch_assoc($stmt);
      } else {
          echo '&lt;script type="text/javascript&gt;"&gt;alert("Something went wrong");&lt;/script&gt;';
      }
  }
  
  $info = read("users", $_SESSION['uid']);
  $char = read("characters", $_SESSION['uid']);
  </code></pre>
  
  <p>Do i still need to escape anything? I know, i know, i've read it everywhere that you dont need to escape when using prepared statements, but then there are questions like <a href="https://stackoverflow.com/questions/9181160/pdo-mysql-prepared-statements-not-escaping-characters">this</a> and <a href="https://stackoverflow.com/questions/7176683/prepared-statement-not-escaping-apostrophe">this</a> that make me worried.</p>