In PHP, why can only values be bound as parameters and not column names?

In PHP, only values can be bound as parameters in prepared statements because parameter binding is meant to prevent SQL injection attacks by separating the data from the query logic. Column names cannot be bound as parameters because they are part of the query structure itself and should not be interchangeable. To dynamically set column names in a query, you can use string concatenation to build the query with the desired column names. 

// Example of dynamically setting column names in a query
$column = "column_name";
$value = "example_value";

$stmt = $pdo->prepare("SELECT * FROM table_name WHERE $column = :value");
$stmt->bindParam(':value', $value);
$stmt->execute();

Keywords

PHP parameters values column names binding

Related Questions