Listing products from a database I've this function to list products from database by category. I'm using prepared statements, but wouldn't this make it pretty pointless to use them?

function getProducts($category,$search_param,$pdo){
      $query = "SELECT * FROM renkaat 
        INNER JOIN ajoneuvotyypit ON tyyppiID = ajoneuvotyyppiID 
        INNER JOIN vuodenajat ON vuodenaikaID = renkaat.vuodenaika
        INNER JOIN valmistajat ON renkaat.valmistaja = valmistajat.valmistajaID
        WHERE renkaat.$category= ?
        ";
    $smt = $pdo-&gt;prepare($query);
    $smt-&gt;execute(array($search_param));

      //do stuff
  }


And the function is simply called like this, with no escaping done:

getProducts($_GET['category'],$_GET['search_param'],$pdo);


Should I escape the $category?
Yes, $category in your query string, coming directly from $_GET is a problem.

You should validate $category, and that's not exactly the same as escaping. I assume you have a limited set of valid categories in your database, so validation should be something like:

$valid_categories = array("sector", "industry", "company");
if (!in_array($category, $valid_categories)) {
    // no no
}


As for the other part of your question, paraphrased:


  Is it pointless to use prepared statements if there is a variable part in the query?


It's not pointless, because every time you run the query for the same $category value, it can benefit from the previously prepared statement.