MySqlParameter as TableName
I want to use MySqlParameter to pass tableName into query (to prevent slq injections) MySqlCommand cmd = new MySqlCommand("select * from @table"), cn) cmd.Parameters.AddWithValue("@table",TableName); But this is not working. How can I pass tableName as parameter P.S. I tried to change @ to ? - not working Vimvq1987 You cannot pass table name as parameter. You have to use dynamic SQL to do this, so you have to string concentration to do it, for example MySqlCommand cmd = new MySqlCommand(String.Format("select * from {0}",tableName), cn) But because users input the tableName, so SQL injection is