mysql - How can I use a parameterized query to search on a column by its name? -

my users should able search database entering search term in input box , selecting column they'd search on dropdown box.

however, can't find way parameterize query in golang such column name recognized column name instead of value. let me give example:

rows, err := db.query("select * mytable ? = ?", col, searchstr) 

i turned on mysql logging , resulting query:

   41 execute   select *     mytable      'username' = 'foo' 

clearly username should not have single quotes around it.

how can parameterize query? have write application logic check each query proper column names , use string manipulation add column name query (perhaps using placeholder character find-and-replace)?

this trying keep safe bad args (prevent things sql injection) isn't designed replacement on other value. want insert table name. unfortunately code aware of col's type (string) , quotes because in sql it's nvarchar , that's how literals written, enclosed in single quotes. might seem bit hack need instead;

db.query(fmt.sprintf("select * mytable %s = ?", col), searchstr) 

putting table name query string before passing query doesn't treated argument (ie value used in clause).