title: ORA-01036 - illegal variable name/number
body: <p>I have a dynamic SQL for searching records in Oracle, and VS2017 code analysis reports warning about using parameterized SQL query for this line (1st line, this code works):</p>
  
  <pre><code>string SQL = "SELECT " + string.Join(",", my_columns.ToArray()) + " FROM MyTable ";
  string where_condition = " WHERE ";
  
  //the rest of code follows as this...
  if (!string.IsNullOrEmpty(textbox1.Text))
  {
    SQL = string.Concat(SQL, where_condition, " Name like :name");
    cmd.Parameters.Add(new OracleParameter("name", string.Concat("%", textbox1.Text, "%")));
    where_condition = " AND ";
  } //...
  </code></pre>
  
  <p>So, I tried to put column names as parameters because of warning, but then I get ORA-01036- illegal variable name/number error:</p>
  
  <pre><code> string SQL = "SELECT :columns FROM MyTable ";
   cmd.Parameters.Add(new OracleParameter("columns", string.Join(",", 
   my_columns.ToArray())));
   string where_condition = " WHERE ";
  </code></pre>
  
  <p>What is wrong, maybe column names cannot be passed as parameters ? Or is there any other way to avoid warning in VS code analysis ?</p>