Not validated input and query builder class

However, usually those values are hard-coded, and users cannot modify them.

I wrote above. However, this may not be correct.

I imagined SELECT query like:

PHP Code:

$builder->where('name', $name); 


but if a dev writes code like the following:

PHP Code:

$builder->insert($_POST); 


the column names are not hard-coded.

I see what you mean by column names not being hard-coded. I never thought it could be like this without being hard-coded.

Thanks for dispelling the doubts that clouded my mind.