title: C# - Using OleDbParameter on table name
body: <p>I want to protect my app from SQL injection. I want to use OleDbParameter in a SQL query for the table name ({1}).</p>
  
  <p>The problem is that it doesn't work (error in FROM or something like that). I can pass the OleDbParameter in {3} thought.
  Example:</p>
  
  <pre><code>IDbCommand cmd = m_oConnection.CreateCommand();
  cmd.CommandType = CommandType.Text;
  cmd.CommandText = String.Format("SELECT {0} FROM {1} WHERE {2}={3}",
                  "ParentID",
                  "?",
                  sWhere,
                  "?"
  );
  cmd.Parameters.Add(new OleDbParameter("@sTable", sTable));
  cmd.Parameters.Add(new OleDbParameter("@id", id));
  </code></pre>
  
  <p>What can I do? Am I forced to write a function which escapes some SQL characters by hand? If yes, where can I find a perfect function?</p>
  
  <p>Thanks</p>