title: Dynamically providing column name in VB MySQL programming
body: <p>So I've got this MySQL query in my code:</p>
  
  <pre><code>Sub MySub(column_name As String)
      Dim sqlQueryString As String = "SELECT * FROM foo WHERE " &amp; column_name &amp; " IS NULL;"
  </code></pre>
  
  <p>Imagine my SQL table comprises of two columns, column_A and column_B.</p>
  
  <p>I want to pass in "column_A" or "column_B" as a method argument, but this leaves me very open to SQL injection. I looked into passing in the values with .Parameters.Add or .Parameters.AddWithValue, but this results in turning "column_name" into a String value and not a proper column name (because it encapsulates the value in quotations, turning it into a String). How can I work around this?</p>