title: How to prevent SQL injection when dealing with dynamic table/column names?
body: <p>I am using jdbc PreparedStatement for data insertion.</p>
  
  <pre><code>Statement stmt = conn.prepareStatement(
  "INESRT INTO" + tablename+ "("+columnString+") VALUES (?,?,?)");
  </code></pre>
  
  <p><strong><em>tablename</em></strong> and <strong><em>columnString</em></strong> are something that is dynamically generated.</p>
  
  <p>I've tried to parameterise tablename and columnString but they will just resolve to something like 'tablename' which will violate the syntax.</p>
  
  <p>I've found somewhere online that suggest me to lookup the database to check for valid tablename/columnString, and cache it somewhere(a Hashset perhaps) for another query, but I'm looking for better performance/ quick hack that will solve the issue, perhaps a string validator/ regex that will do the trick.</p>
  
  <p>Have anyone came across this issue and how do you solve it?</p>