query("SHOW COLUMNS FROM users"); $columns = $stmt->fetchAll(PDO::FETCH_COLUMN); // Exclude sensitive fields like password $allowed_fields = array_diff($columns, ['password']); } catch (PDOException $e) { // Handle error, maybe default to a safe subset of fields $allowed_fields = ['id', 'name', 'email', 'role']; } } function get_users($fields) { if (empty($fields)) { return []; // No read permission } // Always include id for edit/delete links if (!in_array('id', $fields)) { $fields[] = 'id'; } // Replace role_id with a join to get the role name $select_parts = []; foreach ($fields as $field) { if ($field === 'role_id') { $select_parts[] = 'r.name as role_name'; } else { $select_parts[] = 'u.' . $field; } } $select_fields = implode(', ', $select_parts); try { $pdo = db(); $sql = "SELECT $select_fields FROM users u LEFT JOIN roles r ON u.role_id = r.id ORDER BY u.created_at DESC"; $stmt = $pdo->query($sql); return $stmt->fetchAll(PDO::FETCH_ASSOC); } catch (PDOException $e) { return ['error' => 'Database error: ' . $e->getMessage()]; } } $users = get_users($allowed_fields); ?>