Question

I am bit confused as when try the code below I receive the desired result.

   include_once('config.class.php');
   $db = Core::getInstance();     
   $whr = '[e-mail]';

  $inv = $db->dbh->prepare("SELECT * FROM ruj_users WHERE email=:whr");
  $inv->execute(array(":whr"=>$whr));
  $row = $inv->fetch(PDO::FETCH_ASSOC);
    echo $row['email'];
    echo $row['full_name'];

However, when I run the following code it returns 1 not the desired result.

     include_once('config.class.php');
     $db = Core::getInstance();     
     $whr = '[e-mail]';    

     function fetchUser($whr){  
    $db = Core::getInstance();              
    $inv = $db->dbh->prepare("SELECT * FROM ruj_users WHERE :whr");
            $inv->execute(array(':whr'=>$whr)); 
    $res = $inv->fetch(PDO::FETCH_ASSOC);
    return $res;
}
    $row = fetchUser("email = '".$whr."' "); 
    echo $row['email'];
    echo $row['full_name'];

Answer 1

This query:

SELECT * FROM ruj_users WHERE :whr

When expanded:

SELECT * FROM ruj_users WHERE 'email = \'[e-mail]\''

The expression email = \'[e-mail]\' will be evaluated by MySQL as a boolean and is always truthy, so it will return all rows in ruj_users.

If you want custom conditions, you can do something like this:

function fetchUser(array $conditions)
{
    // ...
    $sql = 'SELECT * FORM ruj_users WHERE';
    $params = array();
    foreach ($conditions as $column => $value) {
        if (preg_match('/^[a-z]+$/', $column)) {
            $sql .= "`$column` = ?";
            $params[] = $value;
        }
    }
    $inv = $db->dbh->prepare($sql);
    $inv->execute(array_values($params));
    // ...
}

fetchUser(array(
    'email' => '[e-mail]',
    'status' => 23,
));