title: Can I parameterize the table name in a prepared statement?
body: <p>I've used the mysqli_stmt_bind_param function several times. However, if I separate variables that I'm trying to protect against SQL injection I run into errors.</p>
  
  <p>Here's some code sample:</p>
  
  <pre><code>function insertRow( $db, $mysqli, $new_table, $Partner, $Merchant, $ips, $score, $category, $overall, $protocol )
  {
      $statement = $mysqli-&gt;prepare("INSERT INTO " .$new_table . " VALUES (?,?,?,?,?,?,?);");
      mysqli_stmt_bind_param( $statment, 'sssisss', $Partner, $Merchant, $ips, $score, $category, $overall, $protocol );
      $statement-&gt;execute();
  }
  </code></pre>
  
  <p>Is it possible to somehow replace the <code>.$new_table.</code> concatenation with another question mark statement, make another bind parameter statement, or add onto the existing one to protect against SQL injection?</p>
  
  <p>Like this or some form of this:</p>
  
  <pre><code>function insertRow( $db, $mysqli, $new_table, $Partner, $Merchant, $ips, $score, $category, $overall, $protocol )
  {    
      $statement = $mysqli-&gt;prepare("INSERT INTO (?) VALUES (?,?,?,?,?,?,?);");
      mysqli_stmt_bind_param( $statment, 'ssssisss', $new_table, $Partner, $Merchant, $ips, $score, $category, $overall, $protocol );
      $statement-&gt;execute();
  }
  </code></pre>