Question

Here’s an example wrapper for an SQL query

public function where ($col, $val)
{
    if (!preg_match('~^[a-z0-9_]+$~i', $col))
        throw new Exception('Invalid parameter $col');

    $this->where.= "WEHERE $col = :$col";
}

Is this quite overkill since regex is probably using resources.
Note I am actually using this to wrap PDO (notice the colon in :$col).

Answer 1

If $col can be specified through user input then this is not overkill but rather your only defense against SQL injection.

If $col is known safe (for example your code produces its value with a switch statement) then it’s probably not worth it to include the runtime check. But you should take into account the possibility of the “known safe” status changing as the program is maintained in the future.