title: Secure a dynamic where clause (PDO)
body: <p>In my form I have a select and an input, like this:</p>
  
  <pre><code>&lt;div class="row"&gt;
    &lt;div class="col-md-4"&gt;
      &lt;select id="select-column" name="column" class="form-control"&gt;
        &lt;option value="bin_id"&gt;Bin ID&lt;/option&gt;
        &lt;option value="table_col_one"&gt;Column One&lt;/option&gt;
        &lt;option value="table_col_two"&gt;Column Two&lt;/option&gt;
        &lt;option value="table_col_three"&gt;Column Three&lt;/option&gt;
      &lt;/select&gt;
    &lt;/div&gt;
  
    &lt;div class="col-md-8"&gt;
      &lt;div&gt;
        &lt;input id="search" name="term" type="text" class="form-control"&gt;
      &lt;/div&gt;
    &lt;/div&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p>The user selects a column in which to search, here is my SQL query:</p>
  
  <pre><code>$term = $_POST['term'];
  $column = $_POST['column'];
  
  $sql = "SELECT $column FROM packing_master WHERE $column LIKE :term AND invoice != '' group by $column LIMIT 35";
  $stmt = $bdd-&gt;prepare($sql);
  $stmt-&gt;bindParam(':term', $term);
  $stmt-&gt;execute();
  </code></pre>
  
  <p><strong>But how to secure the request?</strong> Because it is vulnerable to sql injection?</p>