Sql - field as a parameter

Hello friends,

Is it correct a correct practice to pass the field for an sql query as a parameter.

Example:

SELECT *

FROM view_student

WHERE 

year = $P!{year}  AND $P!{filter_field} = $P!{filter_value}

Thanks for your help