table name sql injection
<p>I am working with C#. I need to write a select inline query.</p>

<p>The table name should be taken from config. I cannot write a stored procedure.</p>

<pre><code>SqlCommand myCommand= new SqlCommand();
myCommand.CommandText = "Select  * from " + tableName;
myCommand.CommandType = CommandType.Text;
myCommand.Connection = connString;
</code></pre>

<p>How to avoid sql injection ?</p>
