c# - How to use parameters in SQL query with column name -

c# - How to use parameters in SQL query with column name -

i have next sql query takes header file , creates column same name header:

sqlcommand createtable = new sqlcommand("create table " + tbxlstablename.text + " (" + dc.columnname + " varchar(max))", myconnection);

it open sql injection attack decided utilize parameters this:

string strcreatetable = "create table @tablenamecreatexls (" + dc.columnname + " varchar(max))"; sqlcommand createtable = new sqlcommand(strcreatetable, myconnection); createtable.parameters.addwithvalue("tablenamecreatexls", tbxlstablename.text);

dc datacolumn object.

i getting next error:

incorrect syntax near @tablenamecreatexls

how can resolve error?

you can't utilize parameters table name , column names, can utilize sqlcommandbuilder.quoteidentifier method escape values. like:

sqlcommandbuilder sqlbuilder = new sqlcommandbuilder(); string columnname = dc.columnname;//"somecolumn" string tablenamecreatexls = "sometable"; string escapedcolumnname = sqlbuilder.quoteidentifier(columnname); string escpaedtablename = sqlbuilder.quoteidentifier(tablenamecreatexls); string strcreatetable = string.format("create table {0} ({1} varchar(max))",escpaedtablename, escapedcolumnname);

c# sql sql-server datacolumn