title: Proper insertion of table name
body: <p>How does one correctly provide the table name if the name can be dynamically determined and still prevent SQL injection attacks? I am using <a href="https://github.com/brianc/node-postgres" rel="nofollow noreferrer">node-postgres</a>.</p>
  <p>For example:</p>
  <p>The following works but I believe is insecure:</p>
  <pre><code>dbclient.query(&quot;INSERT INTO &quot; + table_name + &quot; VALUES ($1, $2, $3)&quot;, [value_a, value_b, value_c])`
  </code></pre>
  <p>What I would like equivalently (but does not work) is:</p>
  <pre><code>dbclient.query(&quot;INSERT INTO $1 VALUES ($2, $3, $4)&quot;, [table_name, value_a, value_b, value_c])`
  </code></pre>