In place edit update text [closed] - php

Question

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
Closed 8 years ago.
This question was caused by a typo or a problem that can no longer be reproduced. While similar questions may be on-topic here, this one was resolved in a way less likely to help future readers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Improve this question
I'm trying to do in-place editing way in my site.
Now I set up all the things I need.
When the user clicks Submit, it will send the id of the div element (what kind of content) and the new value to update.
Here's my code:
if($pedit = $mysqli->prepare("UPDATE `accounts` SET ? = ? WHERE `id`= ? ")){
$pedit->bind_param("sss", $id, $value, $_SESSION["user_id"]);
$pedit->execute();
$pedit->free_result();
$pedit->close();
}
I don't know why it doesn't update the information.
$id = the row that change: description, fullname, email etc.
$value = the new information about $id. User can update his profile information.
The code doesn't show me any kind of error but still doesn't update.

Answer 1

You can't specify a column name as a parameter in a prepared statement. You'll instead have to substitute column names into the statement before preparing it. Don't forget to whitelist editable column names to make sure no unwanted SQL gets executed.
<?php
$accounts_editable_cols = array(
'name'=>true, 'street'=>true, 'city'=>true,
'region'=>true, 'postal'=>true, 'phone'=>true
);
// prevent SQL injection by whitelisting column names
if (!array_key_exists($id, $accounts_editable_cols)) return false;
$pedit = $mysqli->prepare("UPDATE `accounts` SET $id = ? WHERE `id`= ? ")
if ($pedit) {
$pedit->bind_param("ss", $value, $_SESSION["user_id"]);
$pedit->execute();
$pedit->free_result();
$pedit->close();
}