query: Is it bad to pass a column name as a parameter in a query, based on user input?
positive_passages.docid: 255
positive_passages.text: How can I prevent SQL injection in PHP?
negative_passages.docid: 88415
negative_passages.text: Pass table valued parameter using ADO.NET
negative_passages.docid: 103458
negative_passages.text: Column vs Field: have I been using these terms incorrectly?
negative_passages.docid: 126845
negative_passages.text: WHERE IS NULL, IS NOT NULL or NO WHERE clause depending on SQL Server parameter value
negative_passages.docid: 89573
negative_passages.text: Can we have the table name as "option" in MySQL?
negative_passages.docid: 8989
negative_passages.text: When to use single quotes, double quotes, and backticks in MySQL
negative_passages.docid: 85849
negative_passages.text: Can I use a PDO prepared statement to bind an identifier (a table or field name) or a syntax keyword?
negative_passages.docid: 26247
negative_passages.text: How to use an user variables in MySQL LIKE clause?
negative_passages.docid: 114718
negative_passages.text: Is there a DBMS that allows the "= NULL" syntax?
negative_passages.docid: 74192
negative_passages.text: Is storing a delimited list in a database column really that bad?
negative_passages.docid: 32000
negative_passages.text: PDO - passing a field name as a variable
negative_passages.docid: 10136
negative_passages.text: How can I add user-supplied input to an SQL statement?
negative_passages.docid: 112780
negative_passages.text: pass parameter in table valued function using select statement
negative_passages.docid: 15054
negative_passages.text: Does PostgreSQL optimize adding columns with non-NULL DEFAULTs?
negative_passages.docid: 36454
negative_passages.text: Can you use an alias in the WHERE clause in mysql?
negative_passages.docid: 6353
negative_passages.text: Parameterize an SQL IN clause
negative_passages.docid: 6430
negative_passages.text: python list in sql query as parameter