title: Variable column names using prepared statements
body: <p>I was wondering if there was any way to specify returned column names using prepared statements.</p>
  <p>I am using MySQL and Java.</p>
  <p>When I try it:</p>
  <pre><code>String columnNames=&quot;d,e,f&quot;; //Actually from the user...
  String name = &quot;some_table&quot;; //From user...
  String query = &quot;SELECT a,b,c,? FROM &quot; + name + &quot; WHERE d=?&quot;;//...
  stmt = conn.prepareStatement(query);
  stmt.setString(1, columnNames);
  stmt.setString(2, &quot;x&quot;);
  </code></pre>
  <p>I get this type of statement (printing right before execution).</p>
  <pre><code>SELECT a,b,c,'d,e,f' FROM some_table WHERE d='x'
  </code></pre>
  <p>I would, however, like to see:</p>
  <pre><code>SELECT a,b,c,d,e,f FROM some_table WHERE d='x'
  </code></pre>
  <p>I know that I cannot do this for table names, as discussed
  <a href="https://stackoverflow.com/questions/1208442/using-prepared-statements-to-set-table-name">here</a>, but was wondering if there was some way to do it for column names.</p>
  <p>If there is not, then I will just have to try and make sure that I sanitize the input so it doesn't lead to SQL injection vulnerabilities.</p>