这是一个粗略的示例，但应该可以给予您对需要执行的操作有所了解：

// whitelist of column names which can be accepted via user input
$column_whitelist = ['col1', 'col2', 'col3'];

if (!in_array($_GET['col_name'], $column_whitelist)) {
    // do your error handling
} else {
    $ii = $_GET['col_name'];

    // prepare your SQL query    
    $stmt = $pdo->prepare("UPDATE nota SET `$ii` = ? WHERE id = ?");

    // pass in the variables to be bound to the placeholders in
    // the query and execute it
    $stmt->execute([$nom_aux, $id]);
}

或者，您可以为用户提供一个select元素来选择他们要搜索的列：

<select name="col_name">
    <option value="1">col 1</option>
    <option value="2">col 2</option>
    <option value="3">col 3</option>
</select>

然后在你的PHP中做一些类似的事情：

$column_whitelist = [
    1 => 'my_table_col_1',
    2 => 'my_table_col_2',
    3 => 'my_table_col_3'
];

if (isset($column_whitelist[(int)$_GET['col_name']])) {
    $ii = $column_whitelist[(int)$_GET['col_name']];

    // prepare your SQL query    
    $stmt = $pdo->prepare("UPDATE nota SET `$ii` = ? WHERE id = ?");

    // and so on
}