What are some best practices for handling dynamic table field names in PHP functions?

When dealing with dynamic table field names in PHP functions, it is important to sanitize and validate user input to prevent SQL injection attacks. One way to handle dynamic field names is to use prepared statements with placeholders for the field names. This allows for safe and secure execution of SQL queries with user-provided field names. 

// Example of handling dynamic table field names using prepared statements

function getFieldValue($tableName, $fieldName, $id) {
    $conn = new PDO("mysql:host=localhost;dbname=myDB", "username", "password");
    
    $stmt = $conn->prepare("SELECT $fieldName FROM $tableName WHERE id = :id");
    $stmt->bindParam(':id', $id);
    $stmt->execute();
    
    $result = $stmt->fetch(PDO::FETCH_ASSOC);
    
    return $result[$fieldName];
}

// Example usage
$table = "users";
$field = "username";
$id = 1;

$value = getFieldValue($table, $field, $id);
echo $value;

Keywords

PHP dynamic table field names functions best practices

Related Questions