title: Does sanitizing input data prevent sql injection?
body: <p><strong>Well, table and column names cannot be replaced by parameters in PDO.</strong> As a requirement, mentioning <code>static column name</code> is not possible here. So, I use <code>santize</code>. Is it enough to prevent sql injection like <code>bind param</code> method. What can be best method ?</p>
  
  <pre><code>$id = filter_var($_POST['id'], FILTER_SANITIZE_STRING);
  $text = filter_var($_POST['text'], FILTER_SANITIZE_STRING);
  $column_name = filter_var($_POST['column_name'], FILTER_SANITIZE_STRING);
  $result = $con-&gt;query("UPDATE menu SET $column_name='$text' WHERE mid=$id") OR die($con-&gt;error);  
  </code></pre>