Sometimes you genuinely need the set of columns to update to be data, not code. An operator maps configuration fields to database columns, and you want to honor that mapping without redeploying every time it changes. The naive solution — build an UPDATE string from those column names — is also one of the easiest ways to hand-write a SQL injection vulnerability. This is how to get the flexibility without the hole.
We'll build it up in three layers: make it work, make it safe, then count the cost.
Layer 1: The dynamic update, the wrong way
The tempting version concatenates column names into SQL:
// DO NOT do this.
