I can't figure out how to parametrize my SQL statement - lil help please?

Question

Hi all,
I was deleting records via the string-concatenation method, which I've come to understand is bad, due to security any possibly other issue. I want very much to parametrize my delete statement, but I just can't see to get it to work
The code below is my best shot at it - it returns an Oracle exception about "invalid table name". I assume that means the the substitution of the parameter for the value simply hasn't been performed, so the database is trying to process literally ":oracleTable", and the like.
Can someone please set me straight with this?
Thanks for any help,
cdj
          public static void DeleteTest(DateTime start, DateTime end)
               ParentFormStatusBar.Text = "Deleting records...";
               string oracleStart = start.ToString("dd-MMM-yyyy");
               string oracleEnd = end.ToString("dd-MMM-yyyy");
               string strConn = "CONNECTSTRING";
               OracleConnection dc_UAT = new OracleConnection(strConn);
               string oracleTable = "DATABASETABLE";
               OracleCommand oc = new OracleCommand();
               oc.BindByName = true;
               oc.CommandText = "delete from :oracleTable where as_of_date between :oracleStart and :oracleEnd";
               oc.Connection = dc_UAT;
               OracleParameter tableParam = new OracleParameter();
               tableParam.ParameterName = "oracleTable";
               tableParam.Value = oracleTable;
               tableParam.OracleDbType = OracleDbType.Varchar2;
               tableParam.Direction = ParameterDirection.Input;
               OracleParameter startParam = new OracleParameter();
               startParam.ParameterName = "oracleStart";
               startParam.Value = start;
               startParam.OracleDbType = OracleDbType.Date;
               startParam.Direction = ParameterDirection.Input;
               OracleParameter endParam = new OracleParameter();
               endParam.ParameterName = "oracleEnd";
               endParam.Value = end;
               endParam.OracleDbType = OracleDbType.Date;
               endParam.Direction = ParameterDirection.Input;
               oc.Parameters.Add(tableParam);
               oc.Parameters.Add(startParam);
               oc.Parameters.Add(endParam);
               MessageBox.Show(tableParam.Value.ToString()+ "\n" + oc.CommandText+"\n" + "Params: " + oc.Parameters.Count);
               int rowsAffected;
               try
                    dc_UAT.Open();
                    rowsAffected = oc.ExecuteNonQuery();
                    dc_UAT.Close();
                    ParentFormStatusBar.Text = rowsAffected.ToString() + " records deleted.";
               catch(Exception ex)
                    ParentFormStatusBar.Text = "Delete error: " + ex.Message;
          }

Answer 1

It helped oodles - thanks a jillion!
Is there a master list somewhere of things you can and cannot parametrize? That would be cool.
I guess I was thinking of parameters oversimplistically as just a canned-search-and-replace-text function or something like that.
Thanks again,
cdj