title: C# SQLite Insert function with dynamically parameters
body: <p>Alright, Maybe the title is a little bit weird, but i will try to explain it.</p>
  
  <p>I'm working on an C# application with an SQLite database file. I've got an DB class where all my functions for communication with the db will be.</p>
  
  <p>I've got an <code>Insert</code> function there with this code ( note, this is not made by me ):</p>
  
  <pre><code>public bool Insert(String tableName, Dictionary&lt;String, String&gt; data)
          {
              String columns = "";
              String values = "";
              Boolean returnCode = true;
              foreach (KeyValuePair&lt;String, String&gt; val in data)
              {
                  columns += String.Format(" {0},", val.Key.ToString());
                  values += String.Format(" '{0}',", val.Value);
              }
              columns = columns.Substring(0, columns.Length - 1);
              values = values.Substring(0, values.Length - 1);
              try
              {
                  this.ExecuteNonQuery(String.Format("insert into {0}({1}) values({2});", tableName, columns, values));
              }
              catch (Exception fail)
              {
                  MessageBox.Show(fail.Message);
                  returnCode = false;
              }
              return returnCode;
          }
  </code></pre>
  
  <p>It all looks good. But i want to prevent some <code>SQLInjection</code> with parameterized queries. But the thing is, that the query never will have the same length. So how will I handle this?</p>
  
  <p>I mean: I want to have this single function for an table with 3 columns, and for an table with 8 columns. All dynamically. Does anybody have any idea on how to do that ( in an nice / right way )?</p>