Query remaining field names from a database table
There are multiple table locations for Drupal field data: the base User entity
table users_field_data &amp; the user__$FIELD tables that contain the custom fields defined by site builder / developer. If you need field data from a DB query, then you're going to need to build a query with a few joins to put it all together.
If you're only looking for the field names then it's much earlier to use the entity field manager to pull the base &amp; custom fields:
\Drupal::service('entity_field.manager')-&gt;getFieldDefinitions('user', 'user')