In ADO.NET, are there restrictions where SQL parameters can be used in the SQL query?
问题 This question is merely for educational purposes, as I'm not currently building any application that builds SQL queries with user input. That said, I know that in ADO.NET you can prevent SQL Injection by doing something like this: OleDbCommand command = new OleDbCommand("SELECT * FROM Table WHERE Account = @2", connection); command.Parameters.AddWithValue("@2", "ABC"); But assuming that your application is designed in such a way that the user can actually enter the name of the table, can you