How do I sanitize SQL without using prepared statements

Question

For some sql statements I can\'t use a prepared statment, for instance:

SELECT MAX(AGE) FROM ?

For instance when I want to vary the table.

Answer 1

In this case you could validate the table name against the list of available tables, by getting the table listing from the DatabaseMetaData. In reality it would probably just be easier to use a regex to strip spaces, perhaps also some sql reserved words, ";", etc from the string prior to using something liek String.format to build your complete sql statement.

The reason you can't use preparedStatement is because it is probably encasing the table name in ''s and escaping it like a string.