title: Using C# SQL Parameterization on Column Names
body: <p>I'm having a problem. I want this to work, but it doesn't:</p>
  
  <pre><code>SqlDataSource.SelectCommand = "SELECT blah1, blah2 FROM myTable WHERE @ColumnName = @Value";
  
  SqlDataSource.SelectParameters.Add("ColumnName", System.Data.DbType.String, "one");
  SqlDataSource.SelectParameters.Add("Value", System.Data.DbType.String, "two");
  </code></pre>
  
  <p>It won't substitue the first paramter "ColumnName." If I remove that parameter and place the column name in it like this, it will work:</p>
  
  <pre><code>SqlDataSource.SelectCommand = "SELECT blah1, blah2 FROM myTable WHERE one = @Value";
  
  SqlDataSource.SelectParameters.Add("Value", System.Data.DbType.String, "two");
  </code></pre>
  
  <p>I have a UI where the user can select the DB column name to search on. I want to protect myself from any sort of injection attacks. Any ideas how I can make this work?</p>
  
  <p>One idea I read about was to use a look-up table to take the index from the <code>DropDownList</code> and pull column names that way. I could make that work, but I'd rather get parameterization working if possible since that seems more natural to me.</p>
  
  <p>Thank you in advance for any help you can provide.</p>