php - Variable in "SELECT $var FROM... ", is this safe or open to sql injection? -

i've been learning prepared statements , binding parameters... had hoped able this:

select ? table id=? 

however, found can't use bound parameter call table or columns searching here. , understand reason behind why after searching here.

that leaves me question. safe use variable this:

$fields = "col1, col2, col3";   select $fields table id=? 

i ask, because have large statement, , it's nice able make statement short , use $fields contains long string. use select all, except i'm storing , binding results (not sure if it's necessary actually... haven't tried use $stmt->get_result() yet, upgraded php able use yesterday).

i have general idea of how sql injection works, , reading i've been doing seems idea of prepared , parametrized statement prevents sql injection having sql not run whole statement, breaks apart put simply...

yet when put $fields variable, opening sql injection have variable directly in statement? $fields hard coded, not coming source other code (not user, not database). don't know extent sql injections can potentially attack, why i'm asking here. can deal long statement, me understand proper way make more secure.

thank you.

$fields hardcoded, not coming source

this means not have worry injections @ all. if using in other place of statement.

you should of course carefull not make "public" later on!