Help with parameters

[Lost User]

Hi I'm using this code:

cmd = new MySqlCommand("SELECT * FROM @table ORDER BY size LIMIT 20", conn);
cmd.Parameters.Add("@table", table);
reader = cmd.ExecuteReader();

However, @table is not replaced with the variable table, and thus I get an exception that my SQL query is not correct. Can someone tell me what I'm doing wrong? regards

[rujuc]

You can solve your problem by taking help from this link http://www.nigelrivett.net/SQLTsql/TableNameAsVariable.html[^] cheers!! :)

[Lost User]

Thanks :) Do I really need stored procedures for this task? I actually just wanted to avoid SQL injections, something like mysql_escape_string(table) does in PHP. regards