title: Escape database object names
body: <p>I need to build a SQL Server 2016 script using string concatenation from within C# (the script will be executed via ADO.NET). I cannot use query parameters, which I would normally do, as the script is more of a setup script and contains non-parameterizable statements.</p>
  
  <p>What's <em>the</em> way to go to escape names such that:</p>
  
  <pre><code>"ALTER DATABASE " + Escape(databaseName) + " ADD ..."
  </code></pre>
  
  <p>is not vulnerable to SQL injection? How to implement <code>Escape</code>? Currently I'm using square brackets around all names, however, that is not enough of course...</p>