dynamic/variable table name C# sqlclient

Question

I have database tables that dynamically gets created. They all have the same name but with a unique ID at the end of the name like for example myTable1, myTable2 and so on.

I have these IDs but the question is how should my SQL look like in C# using sqlclient?

For example:

string sql = "SELECT * FROM myTable"+id;

Works but is still open for SQL injections

I've also tried:

string sql = "SELECT * FROM myTable@id";
command.Parameters.AddWithValue("id", id);

But does not work since the sql reads the table name as myTable@id not for example myTable1

Is there a way to insert parameters for the table name?

You cannot parametrize your table (or column) name. If you want to do that, you need to concatenate together your SQL statement (which always opens the risk of SQL injection) — marc_s
– marc_s, Commented Nov 13, 2013 at 9:47
Just change command.Parameters.AddWithValue("id", id) into sql = sql.Replace("@Id", id.ToString(CultureInfo.InvariantCulture) — adrianm
– adrianm, Commented Nov 13, 2013 at 10:02

Soner Gönül · Accepted Answer · 2013-11-13 09:47:50Z

4

Regular SQL can't have parameters on field names or table names, just on values.

Take a look at Dynamic SQL instead.

SELECT * FROM @tablename

answered Nov 13, 2013 at 9:47

Soner Gönül

99.1k103 gold badges224 silver badges375 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Suraj Singh · Accepted Answer · 2013-11-13 09:56:52Z

0

I think using column names in this particular query may do the job .

string sql = "SELECT colName1, colName2 , colname ......FROM myTable"+id;

answered Nov 13, 2013 at 9:56

Suraj Singh

4,0871 gold badge23 silver badges37 bronze badges

Collectives™ on Stack Overflow

dynamic/variable table name C# sqlclient

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related