[problem description]: when the front end uses Vue.js, to modify user information, some modules have common components;
when the user enters a module (figure 2), click the Save button to update the database;

the backend uses the same SQL (update table name set column name = new value where mobile = a user)
but this [column name, new value, user] are all parameters passed by the front end.
the personal SQL is written as: UPDATE user SET? =? WHERE mobile=?
but asked a colleague, and he said there was a risk of injection
[question]: so how do I write this SQL??