Update PDO bind key and values - php

Question

so I recently switched to use pdo instead of mysqli. now I have a question about binding key values with mysqli. I looped through it escaped the key's and values and used them in my queries now I want to do the same thing in pdo but this isn't working and I don't know why this is my code:
foreach($userdata as $key => $value){
$sql = $this->db->prepare("UPDATE `users` SET :key = :value WHERE `id` = :userid");
$sql->execute(
array(
'key' => $key,
'value' => $value,
'userid' => $userid
)
);
}
ofcourse there's more code to see if it needs update and other type of inputs that need more validation but this is the main query i used but without binding. is this possible with pdo and binding parameter's and values?
this is the error i'm getting:
SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'username' = 'sjerdus' WHERE `id` = '2''

Answer 1

You have this error because you tried to update a field named dynamically. The SET :key = ... can't work because when the parameter will be replaced by its value, it will be escaped (and quoted) by PDO.
If you want to put a variable field name that will be updated, you have to manually concatenate the field name, but you'll have to check for the security yourself.
Try something like this :
//Security checks for $field variable...
$sql = $this->db->prepare("UPDATE `users` SET " . $field . " = :value WHERE `id` = :userid");
$sql->execute(
array(
'value' => $value,
'userid' => $userid
)
);

Answer 2

Here is you could do. I assume that the $userid you have provided is an integer. Where as when you use params in execute() directly. They are considered as string.
foreach($userdata as $key => $value){
$sql = $this->db->prepare("UPDATE `users` SET :key = :value WHERE `id` = :userid");
$sql->bindParam(':key', $key);
$sql->bindParam(':value', $value);
$sql->bindParam(':userid', $userid);
$sql->execute()
);
}
http://php.net/manual/en/pdostatement.bindparam.php