I sure hope you're not accepting table and field names from an untrusted user. If you can't trust the individual who is administrating the application you might

I sure hope you're not accepting table and field names from an untrusted user. If you can't trust the individual who is administrating the application you might want to rethink some things.