How come this vulnerable PDO works instead of prepared statement? [duplicate] - php

Question

This question already has answers here:
Can PHP PDO Statements accept the table or column name as parameter?
(8 answers)
Closed 7 years ago.
There is only one way my PDO query returns result I want, but proper prepared statement gives out only column name.
This returns column name instead of queried row:
$queryPrice = "SELECT :zone FROM express WHERE kg >= :kg LIMIT 1";
$stmt = $conn->prepare($queryPrice);
$stmt->bindParam(':zone', $zone, PDO::PARAM_STR);
$stmt->bindParam(':kg', $_SESSION['weight'], PDO::PARAM_STR);
$stmt->execute();
$price = $stmt->fetchColumn();
This works, but is vulnerable to injection:
$queryPrice = "SELECT $zone FROM express WHERE kg >= :kg LIMIT 1";
$stmt = $conn->prepare($queryPrice);
$stmt->bindParam(':kg', $_SESSION['weight'], PDO::PARAM_STR);
$stmt->execute();
$price = $stmt->fetchColumn();
Why doesn't prepared statement for column name work?
Is there a safe way to achieve desired results?

Answer 1

On the second thought your question appears to be caused by bad database design.
Instead of having zones as columns in the table, you have to have them as data in the single column in another table. And it is clearly proven by the fact that you are trying to address a column name the way only data have to be addressed.
You have reorganize your table, leaving only one column for zones, name for example. And you'll be able to select your zone with a query like this
SELECT name FROM zones WHERE kg > :kg