title: SQLite Parameters - Not allowing tablename as parameter
body: <p>I'm developing an application in AIR via Flex, but I'm not seeing where I'm going wrong with SQLite (I'm used to MySQL). Parameters work, but only in certain instances. Is this part of the built-in sanitation system against sql injection? Thanks for any help!</p>
  
  <p><strong>Works:</strong></p>
  
  <p><em>sqlite</em></p>
  
  <p>"INSERT :Fields FROM Category", where the parameter is :Fields = "*"</p>
  
  <p><em>as3</em></p>
  
  <pre><code>var statement:SQLStatement = new SQLStatement();
  statement.connection = connection;
  statement.text = "INSERT :Fields FROM Category";
  statement.parameters[":Fields"] = "*";
  statement.execute;
  </code></pre>
  
  <p><strong>Doesn't Work (SQL syntax error at ":Table"):</strong></p>
  
  <p><em>sqlite</em></p>
  
  <p>"INSERT :Fields FROM :Table", where the parameters are :Fields = "*" and :Table = "Category"</p>
  
  <p><em>as3</em></p>
  
  <pre><code>var statement:SQLStatement = new SQLStatement();
  statement.connection = connection;
  statement.text = "INSERT :Fields FROM :Table";
  statement.parameters[":Fields"] = "*";
  statement.parameters[":Table"] = "Category";
  statement.execute;
  </code></pre>