PDO Update with variable table, column, row - php

Question

I would like to build an ajax function that updates field variables in some tables.
The tables, fields, and rows are all variable and based on what is posted via the ajax function.
This is the code for my quickedit.php
define( "DB_DSN", "mysql:host=$host;dbname=$data" );
define( "DB_USERNAME", $user );
define( "DB_PASSWORD", $pass );
if(isset($_POST['table'])){ $table = $_POST['table'];}
if(isset($_POST['id'])){ $id = $_POST['id'];}
if(isset($_POST['field'])){ $field = $_POST['field'];}
if(isset($_POST['value'])){ $value = $_POST['value'];}
try {
$con = new PDO( DB_DSN, DB_USERNAME, DB_PASSWORD );
} catch (Exception $e) {
die("Connection Error");
}
try {
$st = $con->prepare("UPDATE :table SET :field = :value WHERE id = :id");
$st->execute(array(':table'=>$table, ':id'=>$id, ':field'=>$field, ':value'=>$value));
} catch (Exception $e) {
die("Query Error");
}
echo "table: ".$table." id: ".$id." field: ".$field." value: ".$value;
As you can see, I wish to dynamically select the table, column, and row.
I'm don't know a whole lot about exceptions, but none of them are being thrown
and it is successfully echoing the stuff at the bottom i told it to.

Answer 1

As you can see, I wish to dynamically select the table, column, and row.
Yes, we see it.
And this is where your idea is wrong.
This is quite contagious disease every good programmer have to outgrow. You are trying to make Universal Updater. Unfortunately, although the idea of some automation is usually all right, too much automation can be a disaster.
Your application have to have an idea what does it update and why. All the queries have to be pre-written and only data part may vary. It's all right to build a dynamical update from the several fields, but makeing even table name dynamical is too much.
As of your particular problem, ORM is what you really looking for. Look how it can be done with Yii Active record:
$post=$table::model()->findByPk($id);
$post->$field=$value;
$post->save(); // save the change to database

Answer 2

You'll need to build the original mysql sentence in the old way, using PHP to evaluate table and column names. Then use PDO to bind values to the fields.
$st = $con->prepare("UPDATE $table SET $field = :value WHERE id = :id");
$st->bindValue(':id',$id,PDO::PARAM_INT);
$st->bindValue(':value',$value,PDO::PARAM_STR);
$st->execute();
Be carefult not to allow quotes or semicolons in the variables youre evaluating. It's fairly easy to perform an SQL injection that way.