mysql - Avoid SQL Injection in query using dynamically loaded tables and database names -

i'm developing system manage in simple way tables in database.

the system first loads ajax databases user can see , manage. load tables in database , load data table.

i have this:

$.ajax({     url : "myurl.php",     data : {         db : $dbselector.val(),         table : tabletoload     },     success : function (json) { /* cool stuff here */ } }); 

and i've found cannot use parameterized queries when parameters db name, tables or columns, cannot do:

<?php $query = "select * :db.:table"; $st = $pdo->prepare($query); $st->execute(     array(         "db"=>$db,          "table" => $table     ) ); $rows = $st->fetchall(pdo::fetch_obj); 

i cannot use mysql_ or mysqli_ filtering cause don't have installed.

you can use:

$db = substr($dbh->quote($db), 1, -1); 

or remove non-alphanumeric characters with:

$db = preg_replace('/\w/', '', $db);