title: prevent sql injection on query with variable (and large) number of columns
body: <p>I have a sql query that is generated using php. It returns the surrogate key of any record that has fields matching the search term as well as any record that has related records in other tables matching the search term.</p>
  
  <p>I join the tables into one then use a separate function to retrieve a list of the columns contained in the tables (I want to allow additions to tables without re-writing php code to lower ongoing maintenance).</p>
  
  <p>Then use this code</p>
  
  <pre><code>foreach ($col_array as $cur_col) {
      foreach ($search_terms_array as $term_searching) {
          $qry_string.="UPPER(";
          $qry_string.=$cur_col;
          $qry_string.=") like '%";
          $qry_string.=strtoupper($term_searching);
          $qry_string.="%' or ";
      }
  }
  </code></pre>
  
  <p>To generate the rest of the query string</p>
  
  <pre><code>select tbl_sub_model.sub_model_sk from tbl_sub_model inner join [about 10 other tables]
  
      where [much code removed] or UPPER(tbl_model.image_id) like '%HONDA%' or
   UPPER(tbl_model.image_id) like '%ACCORD%' or UPPER(tbl_badge.sub_model_sk) like '%HONDA%'
   or UPPER(tbl_badge.sub_model_sk) like '%ACCORD%' or UPPER(tbl_badge.badge) like '%HONDA%'
   or UPPER(tbl_badge.badge) like '%ACCORD%' group by tbl_sub_model.sub_model_sk
  </code></pre>
  
  <p>It does what I want it to do however it is vulnerable to sql injection. I have been replacing my mysql_* code with pdo to prevent that but how I'm going to secure this one is beyond me. </p>
  
  <p>So my question is, how do I search all these tables in a secure fashion?</p>