Phi11W

You can work with hyphenated attribute names, but you have to wrap them up a bit more:  
$var2=$dolar->{'class-variacion'};  

If you're building an API, then it should be built and run on your own infrastructure (servers).  
If this is the case, then your Oracle database should absolutely not be exposed to the external network. 
Anything on your machine(s)?  That can be trusted.  (Mostly).  Anywhere else to your machine?  That's not trusted.  
Only the Web URL should be made available to the client and that will require you to have a Web server process (again, running on your infrastructure) that will receive those requests and process them as required. 
Do not try to use your database "like" a web server.  
Web servers have all sorts of clever "stuff" in them to protect themselves (and your Data) from the Ne'er-do-well's "out there" on the Wild, Wild Web.  
Your database does not. 
Regards, 
   Phill  W.
 
 

Over the lifetime of this (or any other) Application, you will spend far more time reading its code than you will writing any of it so go for whichever form expresses your intention most clearly. 
Personally, I'd go with the former or, perhaps, an even more concise one: 
if ( ! isset( $_SESSION['user'] ) ) exit ; if ( 'SiteOwner' !== $_SESSION['user'] ) exit ; I'm not sure of the context in which this runs - perhaps a redirect to another page might be more appropriate than the "exit"?  YMMV. 
Regards, 
   Phill  W.
 

You have an array containing the field names that were passed into the function. 
That array is used to build the SQL statement so those columns will be returned in each row.  
Now, for each row in the returned data, you need to loop through your fields array and pull out each value from the row, by field name, something like this: 
while( $row = $results->fetch_assoc() ){ $dlm = ''; foreach( $fields as $field ){ echo $dlm . $row[ $field ]; $dlm = "\t"; } }  
Regards, 
   Phill  W.