Odtnhj

I'm using NodeJS and MariaDB. I have a lot of tables where some Users can change a value via requests. I don't want to prepare queries for every column the user wants to update like:

module.exports.updateName = (name,id) =>
 return pool.query("UPDATE Users SET name=? WHERE user_id=?;", [name,id])

module.exports.updateAge = (name,id) =>
 return pool.query("UPDATE Users SET age=? WHERE user_id=?;", [age,id])

I want to build s.th. like a template which expects the table, columns and values.
In order to prevent SQL Injection attacks I'm already using the ? placeholders for the values. Unfortunately MariaDB doesn't support placeholders for identifiers like ??.
I don't feel safe to just concat the table name or the columns to the query string like:

"SELECT INTO " + tablename +"(" + columns + ")" ...

My idea was to query at every sever start, which table and column names exist in my database and store them in a list. Then i could check whether the passed table and column strings are valid or not.

Does this idea makes sense or is a common way? How would handle that problem?
I'm thankful for every advice!

Greetings

Well, what I'd do is to create a stored procedure with params, user, column, value and inside it would decide what update statement to use, like so:

create procedure updateValues (in uid int, in columnid int, in value int)...
begin
 if columnid = 0 then
 update users set name = value;
 else if columnid = 1 then
 update users set age = value;
 end if
end