PHP - Prepared statements error, what's wrong?

Question

So here's the codeblock:

        $query = "UPDATE users SET ?=? WHERE ?=?";

        $type = "s";
        $type .= substr(gettype($valname), 0, 1);
        $type .= 'i';

        if ( $smtp = $this->conn->prepare($query) )
        {
            $smtp->bind_param($type, $colname, $valname, 'id', 40);
            $smtp->execute();
            $smtp->close();

        }else
        {
            return $this->conn->error;

        }

For some reason it refuses to bind the parameters, and it gives me this error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '?=? WHERE ?=?' at line 1

If i add backticks ( ` ) or singlequotes ( ' ) around the questionmarks i get this error instead:

Unknown column '?' in 'where clause'

Any ideas what's gone wrong? I've been sitting here for hours playing with it, god it's frustrating!!

Thanks a bunch!

Answer 1

I do not think you can define the column dynamically in a prepared statement, only values, as these are escaped etc. You will need to put the column name in the $query string, if it comes from an unknown source make sure you filter it and validate it.

Answer 2

As far as I know, you can only use ? placeholders for the condition, not for table/field names.

See: http://php.net/manual/en/pdo.prepared-statements.php