重叠模式匹配(Overlapping pattern matches)

 是的，PDO没有用于分隔表名和列名等标识符的内置函数。 PDO::quote()函数仅用于字符串文字和日期文字。 
 
 对于它的价值，当我使用Zend Framework时，我实现了一个quoteIdentifier()函数。 
 
 你说得对， SELECT *提取所有列，可能会使用更多的内存并破坏覆盖索引的好处。 
 
 我的建议是将列名列入白名单 。 也就是说，确保$ info实际命名一table 。 那么你不必担心列名不存在，或者包含一个奇怪的字符或任何东西。 您可以控制要放入查询的合法列。 
 
 无论如何，你也应该分隔列名。 如果列名包含标点符号，空格，国际字符或匹配SQL保留字，则分隔标识符是必需的。 请参阅不同的数据库使用不同的名称引号 
 
function getInfoById($id, $info) {
    // you can make this a literal list, or query it from DESC or INFORMATION_SCHEMA
    $cols = array('col1', 'col2', 'col3');

    if (array_search($info, $cols) === false) {
      return false;
    }
    $sql = "SELECT `$info` FROM table WHERE id = :id";
    $stmt = $pdo->prepare($sql);
    if ($stmt === false) {
      return false;
    }
    . . .
}
 
 我在演示文稿SQL注入神话和谬误中展示了更多白名单示例。 

Yes, PDO does not have a builtin function for delimiting identifiers like table names and column names. The PDO::quote() function is only for string literals and date literals.
 
For what it's worth, when I worked on Zend Framework, I implemented a quoteIdentifier() function.
 
You're right that SELECT * fetches all columns, likely using more memory and spoiling the benefit of covering indexes.
 
My recommendation is to whitelist column names. That is, make sure $info actually names a column of table. Then you don't need to worry about the column name not existing, or containing a strange character, or anything. You get to control the set of columns that are legitimate to put in the query.
 
You should also delimit the column name anyway. Delimited identifiers are necessary if the column name contains punctuation, whitespace, international characters, or matches an SQL reserved word. See Do different databases use different name quote?
 
function getInfoById($id, $info) {
    // you can make this a literal list, or query it from DESC or INFORMATION_SCHEMA
    $cols = array('col1', 'col2', 'col3');

    if (array_search($info, $cols) === false) {
      return false;
    }
    $sql = "SELECT `$info` FROM table WHERE id = :id";
    $stmt = $pdo->prepare($sql);
    if ($stmt === false) {
      return false;
    }
    . . .
}
 
I show more examples of whitelisting in my presentation SQL Injection Myths and Fallacies.