Table name and table field on SqlParameter C#?

Solution 1:

If you are worried about SQL injection, the SqlCommandBuilder class (and other DB specific versions of DbCommandBuilder) have a function called QuoteIdentifier that will escape your table name properly.

var builder = new SqlCommandBuilder();
string escTableName = builder.QuoteIdentifier(tableName);

Now you can used the escaped value when building your statement and not have to worry about injection- but you should still be using parameters for any values.

Solution 2:

I guess you are trying to execute a sql statement like

select @field from @table

but that will not work. Sql can't have parameters on fieldnames or tablenames, just on values.

If my guess wasn't correct, please extend your question.