Typically parameterized query APIs (such as PHP's PDO) only support dynamic parameters for elements that do not affect the query plan, that is, as replacements

Typically parameterized query APIs (such as PHP's PDO) only support dynamic parameters for elements that do not affect the query plan, that is, as replacements for literal strings or numbers. Dynamic identifiers, such as table/column names, sort direction, etc., are not allowed. This permits an additional benefit – the DB can compile a prepared statement once and reuse its compiled form for multiple executions.