Sanitising user inputs for other variables

bettermysql-sanitize-input.php

<?php
  // Assuming that database connection is already open
  
  // Let's say a user is allowed to provide a table name to query from
  $tableName = trim($_GET['tableName']);

  // This would NOT work (no good!)
  $stmt = $db->prepare("SELECT user, id, email FROM :table WHERE id > 1000");
  $stmt->bindParam(':table', $tableName);
  $stmt->execute();
  // More...
  
  // This would work (OSSOM)
  // Check user input against a whitelist
  $tableNames = array('userdata1', 'userdata2', 'userdata3');
  
  // If user input matches an entry within the whitelist, go ahead
  if(in_array($tableName, $tableNames)) {
     $stmt = $db->prepare("SELECT user, id, email FROM `$tableName` WHERE id > 1000");
     $stmt->execute();
     // More...
  } else {
    // Throw an error
  }
 
?>