SQL - OleDbCommand not changing Sql Parameter

Question

Below is the code for my Select * Function - It WORKS well and does everything great until i change the SQL string from Select * From Company to

        query = "Select * From @1";

and then do the following

        query = "Select * From @1";
        OleDbCommand Command = new OleDbCommand(query, sqlConnStr);

        DataTable Table = new DataTable();
        DataSet dataSet = new DataSet();
        Table = null;

        //Add Parameters
        Command.Parameters.AddWithValue("@1", SQLTables.Company);

        try
        {
            Command.ExecuteNonQuery();
            adapter.SelectCommand = Command;
            adapter.Fill(dataSet);
            Table = dataSet.Tables[0];
        }
        catch (Exception e)
        {
            MessageBox.Show("A Error occured whilst trying to execute the command.\n" + e.Message);
        }

        return Table;

The DBMS keeps sending back "Query incomplete" - I assume The Command variable is sending the string query through without changing the Parameter from @1 to Company

---

Here is a piece of code (mine) where this does work. This is an insert statement rather that a select - Correct me if i am wrong but should it not also work with the SELECT aswell

private void MainActionsInsert(string Action, bool Checked)
{
    OleDbCommand Command = new OleDbCommand("INSERT INTO MainActions Values (ID, Action, BoolValue)", DataBaseConnection);
    //Add Parameters
    Command.Parameters.AddWithValue("ID", GenerateID());
    Command.Parameters.AddWithValue("Action", Action);
    Command.Parameters.AddWithValue("BoolValue",Checked);
    //Add Command
    MainActionsAdapter.InsertCommand = Command;
    //Execute Agains DataBase
    Command.ExecuteNonQuery();
    //Accept Changes
}

`

Answer 1

OleDbCommand Does accept Parameterized SQL just not in the From Clause - It Has to be either in a WHERE clause or something like that. Like you said it Worked with the insert function because it expects "parameters" there. For example this will work

    query = "Select * From Company Where @param = 1";
    OleDbCommand Command = new OleDbCommand(query, sqlConnStr);

    DataTable Table = new DataTable();
    DataSet dataSet = new DataSet();
    Table = null;

    //Add Parameters
    Command.Parameters.AddWithValue("param", "ID");

    try
    {
        Command.ExecuteNonQuery();
        adapter.SelectCommand = Command;
        adapter.Fill(dataSet);
        Table = dataSet.Tables[0];
    }
    catch (Exception e)
    {
        MessageBox.Show("A Error occured whilst trying to execute the command.\n" + e.Message);
    }

    return Table;

Funny though that it doesn't work for the Select part though

Answer 2

OLEdb doesn't recognize named parameters. You must use ? in the query text.

However, you also can't use dynamic table names with parameterized queries, so even using a ? will not help.

You need to use full dynamic SQL, though that can open you up to SQL Injection. Make sure you read the full article I linked.