OdbcParameters in SELECT clause

[dominicpouzin]

I am trying to safely pass the list of fields to select, as in:
OdbcCommand odbcCommand = new OdbcCommand();
odbcCommand.CommandText = "SELECT ? FROM myTable";
odbcCommand.Parameters.Add(new OdbcParameter("@myField",
"myField");
odbcCommand.Connection = myOdbcConnection;
OdbcDataReader odbcDataReader = odbcCommand.ExecuteReader();

This does not work. The returned odbcDataReader did load all expected
rows, but odbcDataReader[0] is set to "myField" (instead of the actual
value of "myField" for each row).

How do I safely pass the list of fields to select using
SQLparameters?

This is using a mySQL ODBC driver.

Thanks!

 

[Arne Vajhøj]

I am trying to safely pass the list of fields to select, as in:
OdbcCommand odbcCommand = new OdbcCommand();
odbcCommand.CommandText = "SELECT ? FROM myTable";
odbcCommand.Parameters.Add(new OdbcParameter("@myField",
"myField");
odbcCommand.Connection = myOdbcConnection;
OdbcDataReader odbcDataReader = odbcCommand.ExecuteReader();

This does not work. The returned odbcDataReader did load all expected
rows, but odbcDataReader[0] is set to "myField" (instead of the actual
value of "myField" for each row).

How do I safely pass the list of fields to select using
SQLparameters?

This is using a mySQL ODBC driver.

I am afraid that you don't.

Parameters is for values. Not for table names or field names.

Dynamic SQL with (!!) input data validation or maybe more practical
just SELECT * and pick from the output via field name.

Arne