mysql_query to pdo conversion error on processing - php

Question

I need help on converting mysql_query to PDO. The MySQL database is not updating when I edit columns. I've tried translating the following code:
<?php
include("connect.php");
if($_GET['id'] and $_GET['data'])
{
$id = $_GET['id'];
$data = $_GET['data'];
$key = $_GET['key'];
if(mysql_query("update information set $key='$data' where id='$id'"))
echo 'success';
}
}
?>
Into this:
<?php
include("connect.php");
if(isset($_GET))
{
$id = $_GET['id'];
$data = $_GET['data'];
$key = $_GET['key'];
}
try {
$pdo = new PDO( DSN, DB_USR, DB_PWD );
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$pdo->query( "SET NAMES utf8" );
$stmt = $pdo->prepare(
"UPDATE information
SET
key=:data where id=:id"
);
$stmt->bindValue( ':id', $id, PDO::PARAM_INT );
$stmt->bindValue( ':key', $data, PDO::PARAM_STR );
$stmt->execute();
} catch (PDOException $e){
var_dump($e->getMessage());
}
$pdo = null;

Answer 1

You used :key in your bindValue() call when it should be :data. You also need to put $key into the query (you can't use a placeholder for a column name, so this requires variable substitution).
$stmt = $pdo->prepare(
"UPDATE information
SET
$key = :data where id=:id"
);
$stmt->bindValue( ':id', $id, PDO::PARAM_INT );
$stmt->bindValue( ':data', $data, PDO::PARAM_STR );
$stmt->execute();
You should validate $key before substituting it, to prevent SQL injection. Something like:
$allowed_keys = array('col1', 'col2', 'col3');
if (!in_array($key, $allowed_keys)) {
die("Bad key $key");
}