php - Binding Columns in Laravel / PDO -

tl;dr: have create white-list of column names (to compare when sanitizing user input) in order let user sort dataset? that's insane amount of overhead, there really no way in modern php world accomplish variable instead?

full story:

i'd let user choose column , direction sort results in data set.

i've accomplished following code:

$sort = input::get('sort'); // column name sort $direction = input::get('direction'); // 'asc' / 'desc' $paginator = db::table('master')                   ->select('style_id', db::raw('max(?) `sort`'))                   ->setbindings(array($sort))                   ->orderby('sort', $direction)                   ->groupby('style_id')                   ->paginate(20); $masters = $paginator->getcollection(); 

this runs no errors, resulting 20 rows seem totally ignore aggregate max requested.

here output of query log on code:

(     [query] => select `style_id`, max(?) `sort` `master` group `style_id` order `sort` desc     [bindings] => array         (             [0] => hot         )      [time] => 2 ) 

...so query looks fine, results not.

it does work, however, if remove column binding , hard-code in column instead:

$paginator = db::table('master')                   ->select('style_id', db::raw('max(`hot`) `sort`'))                   ->orderby('sort', $direction)                   ->groupby('style_id')                   ->paginate(20); $masters = $paginator->getcollection(); 

with query log of:

(     [query] => select `style_id`, max(`hot`) `sort` `master` group `style_id` order `sort` desc     [bindings] => array         (         )      [time] => 2 ) 

this leads me believe either laravel or pdo doesn't allow binding of column names, though make no sense me whatsoever. , expect error message in case.

i'm stumped. in advance help.

one possible solution if somehow escape column name instead of binding it:

->select('style_id', db::raw('max(`' . db::escape($sort) . '`) `sort`')) 

...but there's nothing that, there? mysql_real_escape_string is deprecated , pdo doesn't have replacement it.

am left no choice except create white-list of column names every time want sanitize input?

according this question/answer, there no way in php. insane world live in.

do have create white-list of column names sanitize user input time want let user enter column name variable in query (such sorts , filters)?

yes.

pdo doesn't allow binding of column names,

exactly.

is there no way in modern web world safely bind column name query?

well, in way. in own db wrapper have placeholder column names. dunno laravel may have sleeve too.

however, it's better whitelist anyway.