php - how to remove quotes of any string when preparing queries -

$desc = 'desc';  $getrecords = $conn->prepare('select * `courses` order `id` :sort limit :limitinc, :limit ');  $getrecords->bindvalue(':limit',$limit,pdo::param_int);  // working  $getrecords->bindvalue(':limitinc',$limitinc,pdo::param_int); // working  // *** line below isn't working *** $getrecords->bindvalue(':sort', $desc ,pdo::param_str); // not working  $getrecords->execute(); 

i trying call $desc in prepare query..

fatal error: uncaught exception 'pdoexception' message 'sqlstate[42000]: syntax error or access violation: 1064 have error in sql syntax; check manual corresponds mysql server version right syntax use near ''desc' limit 0, 5' @ line 1' in c:\xampp\htdocs\portfolio\nasiraan\try\indexx.php:89 stack trace: #0 c:\xampp\htdocs\portfolio\nasiraan\try\indexx.php(89): pdostatement->execute() #1 {main} thrown in c:\xampp\htdocs\portfolio\nasiraan\try\indexx.php on line 89

i sure solution is.. remove quotes string $desc... how ??

you have use literal strings i'm afraid, because placeholders can't contain keywords such sorting order (amongst others):

$query = sprintf('select * `courses` order `id` %s limit :limitinc, :limit ',      strcasecmp($desc, 'desc') === 0 ? 'desc' : 'asc') ); $getrecords = $conn->prepare($query); 

building query way isn't bad, because there 2 options.