Java EE (Java Enterprise Edition) General Discussion

Hey,

I was wondering what you guys would recommend to prevent SQL injections. Now, I know that you can use the PreparedStatement and setString for cases like this:

String userName  = request.getParameter("username");
String sqlString = "SELECT * FROM UserTable WHERE USERNAME='" + userName ;

but what can you do when you have cases like these:

String userdef_table  = request.getParameter("userdef_table");
String userName  = request.getParameter("username");
String sqlString = "SELECT * FROM "+ userdef_table +" WHERE USERNAME='" + userName ;

Note: userdef_table can be created by the admin so I wont know what tables are around.

thanks,

domet