title: Passing SQL column names through html input - unwise/unsafe?
body: <p>I'm trying to make a form easy to save using a PHP function.</p>
  
  <p>The HTML looks like:</p>
  
  <pre><code>&lt;form action="" method="POST"&gt;
  &lt;input type="text" name="form[name]"/&gt;
  &lt;input type="text" name="form[lastname]"/&gt;
  </code></pre>
  
  <p>The function for inserting/updating the database contains something like</p>
  
  <pre><code>$data = $_POST['form'];    
  foreach($data as $column =&gt; $value){
  // Creating the SQL statement using $column &amp; $value
  }
  </code></pre>
  
  <p>The table will be passed in php, not through HTML.</p>
  
  <p>Should i be afraid of passing the column names through HTML?</p>