title: SqlDataAdapter -- prevent SQL injection on table name?
body: <p>I have the following code:</p>
  
  <pre><code>SqlDataAdapter adapter = new SqlDataAdapter("SELECT TOP 0 * FROM [tableName]", conn);
  DataTable dt = new DataTable();
  adapter.FillSchema(dt, SchemaType.Mapped);
  </code></pre>
  
  <p>I am using this to build a <code>DataTable</code> of the table schema.</p>
  
  <p>Normally, when people are asking about SQL injection, they are talking about query params :), my question is about the table name:</p>
  
  <pre><code>SELECT TOP 0 * 
  FROM [tableName]
  </code></pre>
  
  <p><code>[tableName]</code> is actually going to be dynamic / determined at runtime (this is for a framework btw)...</p>
  
  <p>The <code>tableName</code> passed into the method is not trusted, so I want to make sure there isn't any funny business going on?</p>
  
  <p>Do I have to manually scrub the table name (and I'm sure I'll miss something)? Or is there a built in method for that? Or somehow to prevent the SQL injection on the table name?</p>