title: Defending vs an Insert SQL Injection attack
body: <p>So we have a custom logger (really wanted to use Log4Net, just wouldn't work for this case).  From a config file, you can configure the name of the table that will be inserted into.</p>
  
  <p>I am parameterizing the insert statement, but the configurable table name will be used in an insert statement, and it's a potential vector for attack.  Here's an example of the statement that will be built:</p>
  
  <pre><code>"insert into " + theTableName + " (static column list) values(parameterized list of values)"
  </code></pre>
  
  <p>So my inserted values are parameterized, and pretty safe, it's theTableName that could contain nasties.</p>
  
  <p>My question is, what can I do to sanitize the table name? I think the nature of the code an attacker would inject would have to be a little different from the garden-variety.  -- instead of a tick, you would potentially close off the statment with  "table name() values(); do something bad -- </p>
  
  <p>(or something like that, I suppose).  To that end, I was thinking about checking for the ";", and the "--".  </p>
  
  <p>Can anyone suggest a better way to sanitize this? (this will be used with Oracle and SQL server)</p>