<p>Why can't I pass the table name to a prepared PDO statement?</p>

<pre><code>$stmt = $dbh-&gt;prepare('SELECT * FROM :table WHERE 1');
if ($stmt-&gt;execute(array(':table' =&gt; 'users'))) {
    var_dump($stmt-&gt;fetchAll());
}
</code></pre>

<p>Is there another safe way to insert a table name into a SQL query? With safe, I mean that I don't want to do</p>

<pre><code>$sql = "SELECT * FROM $table WHERE 1"
</code></pre>

Using the former isn't inherently more safe than the latter, you need to sanitize the input whether it's part of a parameter array or a simple variable.  So I don't see anything wrong with using the latter form with
```
$table
```
, provided you make sure that the content of
```
$table
```
is safe (alphanum plus underscores?) before using it.