title: Safe dynamic PHP SQL WHERE clause
body: <p>What would be a safe way (eg bindParam, prepare()) to insert a dynamic where clause. This is sent to PHP via ajax. So something comes from ajax form with </p>
  
  <pre><code>.php?where=name&amp;what=bob
  </code></pre>
  
  <p>or maybe</p>
  
  <pre><code>.php?where=type$what=clothes
  </code></pre>
  
  <p>Then in PHP after everything is set to variables eg</p>
  
  <pre><code>if(isset($_POST['where'])){
    $where = $_POST['where'];
  }
  if(isset($_POST['what'])){
    $what= $_POST['what'];
  }
  </code></pre>
  
  <p>Then a function is run to retrieve data</p>
  
  <pre><code>function retrieveData($db, $where, $what){
    $getData = $db-&gt;prepare("SELECT name, type, stuff FROM tbl WHERE :where = :what");
    $getData-&gt;bindParam(':what',$what);
    $getData-&gt;bindParam(':where',$where);
    $getData-&gt;execute();
   ..............
  }
  </code></pre>
  
  <p>When I run a query like this i always get the SQL error about</p>
  
  <pre><code>'WHERE name = bob"
  </code></pre>
  
  <p>So the values are passed but I guess the SQL is not valid?</p>
  
  <p>Any help appreciated. Thanks. </p>