title: would it be safe to use functions to access database values?
body: <p>I am pretty new with PHP furthermore PDO so I am not fully aware of what to avoid (and include) when accessing databases apart from SQL injection. (FYI, in the example below the table "users" also include passwords), however would accessing the database using a function as below to get information from be safe? is it prone to attacks? </p>
  
  <p>and if you don't understand why I've done this it's because I find it quicker and it will make it easier when linking tables :)  </p>
  
  <pre><code>&lt;?php
      require("access/common.php");
      function getval($username, $column, $table, $datab){
      $query = " 
      SELECT 
      id, 
      username,
      email 
      FROM ".$table." 
      WHERE 
      username = :username 
      ";
      $query_params = array( 
      ':username' =&gt; $username,
      ); 
      try 
      {
          $stmt = $datab-&gt;prepare($query); 
          $result = $stmt-&gt;execute($query_params); 
      } 
      catch(PDOException $ex) 
      {
          die(); 
      }
      $row = $stmt-&gt;fetch(); 
      if($row) 
      { 
          return $row[$column];
      }
      }
      echo getval("USERNAME", "email", "users", $db);
  ?&gt;
  </code></pre>