Using a parameter for a table name?

Question

In SQL Server, can you use a parameter for a table name?  I'm working with Visual C# and want to do something like this:
SELECT MAX(ItemID) FROM @TableName;
Can this be done?
(Basically, I have three separate methods within a class--one for each table I have; and each one will perform the above query but on different table names.  I'd like to see if there is a way that I can have just one method that will allow me to specify
the table name.)

Answer 1

As pointed out in other posts, you can. But a more relevant question is whether you should.
A table in a relational database is supposed to model a unique entity, and each column in the table is supposed to model a unique attribute. This is not always how it is, but it is from this model a relational database is designed.
From this angle, having a dynamic table name does not really make sense for application code. (Administrative actions is a different story.) Think of it this way: have you ever wanted to make the class name dynamic in C#?
Admittedly, it is different in .NET, because everything inherits from System.Object, but in a relational database there is no inheritence.
Anyway, if you are using stored procedures, you should have one stored procedure per table. Physically, in the plan cache, there will be one query plan per table, no matter how you do it.
If you are submitting SQL statements from your application, it is a different matter. In this case, I find it difficult to object if you have a class that performs generic actions against tables. Then you build the SQL string in the client code.
However, no matter how you do it, you need to be careful to avoid SQL injection. We had the example:
DECLARE @TableName nvarchar(50),@sqlCommand nvarchar(max)
  SET @TableName = ' ItemInformation'
  SET @sqlCommand = 'SELECT MAX(ItemID) FROM ' + @TableName
EXEC (@sqlCommand)
But what if we have:
  SET @TableName = ' sys.objects; SHUTDOWN WITH NOWAIT; --'
As long as we do it in T-SQL, we can (and we should do!) this to prevent SQL injection:
  SET @sqlCommand = 'SELECT MAX(ItemID) FROM ' + quotename(@TableName)
If you build your SQL strings in C#, you will need to employ other checks. There is only an issue if the user can inject data somewhere, but your generic class will not have knowledge of this, and must assume the worst.
Erland Sommarskog, SQL Server MVP, [email protected]