title: Add/remove MySQL column to existing table via PHP / PDO with user defined name and datatype
body: <p>I want users of my PHP web app to be able to insert columns into some tables without requiring somebody with SQL knowledge. What is the best way to do this, obviously SQL injection and id-10-t errors are a concern. </p>
  
  <p>Can I just use </p>
  
  <pre><code>sql = 'ALTER TABLE table_name ADD ? ?'
  </code></pre>
  
  <p>and then pass in say 'new_col' and 'varchar(100)' as strings? Or is this outside the abilities of PDO?</p>