SQL Injection isn't even really an issue with the host programming language. It's an issue with processing input that's submitted "as is". Aside from implement

SQL Injection isn't even really an issue with the host programming language. It's an issue with processing input that's submitted "as is". Aside from implementing bound parameters (which is useful for more than just preventing sql injection), we usually recommend using stored procedures if at all possible. It's really suboptimal to rely on the user to specify what table they're accessing.