C#

CREATE PROCEDURE dbo.BuildSelectStatement
@tableName sysname,
@columnName sysname
AS

-- First, check that the table exists
IF NOT EXISTS (SELECT * FROM INFORMATION_SCHEMA.TABLES 
               WHERE TABLE_NAME = @tableName 
               AND TABLE_SCHEMA = 'dbo' 
               AND TABLE_TYPE = 'BASE TABLE')
BEGIN
    SELECT '' AS result;
    RETURN
END

-- Second, check that the column exists in the table
IF NOT EXISTS (SELECT * FROM INFORMATION_SCHEMA.COLUMNS 
               WHERE TABLE_NAME = @tableName 
               AND TABLE_SCHEMA = 'dbo' 
               AND COLUMN_NAME = @columnName)
BEGIN
    SELECT '' AS result;
    RETURN
END

-- Everything is fine, build the SQL Statement.
SELECT 'SELECT * FROM ['+@tableName+'] WHERE ['+@columnName+'] LIKE @comparison' AS result

GO

SqlCommand buildSqlCmd = new SqlCommand("BuildSelectStatement", myConnection);
buildSqlCmd.CommandType = CommandType.StoredProcedure;
buildSqlCmd.Parmaters.Add("@tableName", tableName);
buildSqlCmd.Paramters.Add("@columnName", this.cbColumn.Text);
string sqlStatment = (string)buildSqlCmd.ExecuteScalar();
if (sqlStatment == "")
{
    // Error, the data was invalid - perform error handling
}

SqlCommand runQueryCmd = new SqlCommand(sqlStatement, myConnection);
runQueryCmd.Parameters.Add("@comparison", 
                           string.Format("%{0}%", this.tbKeyword.Text));
SqlDataReader reader = runQueryCmd.ExecuteReader();

My: Blog | Photos
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More