I'm letting the admin users be able to create tables for polls and this is the query i have:
$aquery = $con->prepare("ALTER TABLE `$table` ADD `$field` $enum DEFAULT '$def' NOT NULL");
the $table and $enum fields are both coming from another table so they are safe, but the $def and $field variables are both coming from the user. How can i check to be sure they are safe to use. I've tried this
$aquery->bindParam(':field', $field);
$aquery->bindParam(':def', $def);
but that doesn't work