title: How do I protect this function from SQL injection?
body: <pre><code>public static bool TruncateTable(string dbAlias, string tableName)
  {
      string sqlStatement = string.Format("TRUNCATE TABLE {0}", tableName);
      return ExecuteNonQuery(dbAlias, sqlStatement) > 0;
  }</code></pre>