title: SqlParameter does not allows Table name - other options without sql injection attack?
body: <p>I got a runtime error saying <code>"Must declare the table variable "@parmTableName"</code>.  Meaning having table name as sql parameter in the sql-statement is not allowed.</p>
  
  <p>Is there a better option or suggestion than allowing sql injection attack?  I don't want to do this C# script for sql statement <code>" DELETE FROM " + tableName + " "</code>;</p>
  
  <pre><code>using(var dbCommand = dbConnection.CreateCommand())
  {
     sqlAsk = "";
     sqlAsk += " DELETE FROM @parmTableName ";
     sqlAsk += " WHERE ImportedFlag = 'F' ";
  
     dbCommand.Parameters.Clear();
     dbCommand.Parameters.AddWithValue("@parmTableName", tableName);
  
     dbConnection.Open();
  
     rowAffected = dbCommand.ExecuteNonQuery();
  }
  </code></pre>