SQL injection in the update field key.

field.php

<?php
$db = new PDO('sqlite::memory:');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->exec("CREATE TABLE user (id int, username string, password string);");
$db->exec("INSERT INTO user VALUES(1, 'admin', 'admin');");
$db->exec("INSERT INTO user VALUES(2, 'demo', 'demo');");

$summary = $_REQUEST['field'];
$bind_vals = [];
$sql_set   = ' ';
foreach ($summary as $key => $value) {
    if (!empty($value)) {
        $bind_vals[':' . $key] = $value;
        $sql_set               = $sql_set . $key . ' = :' . $key;
    }
}
$bind_vals[':id'] = 2;
$sql="update user set " . $sql_set . " where id = :id";
var_dump($sql);

$stmt = $db->prepare($sql);
var_dump($bind_vals);
$r = $stmt->execute($bind_vals);
var_dump($r);

// $res = $db->query("SELECT * FROM user WHERE id = 1");
// var_dump($res->fetchAll());