Is that safe from sqli prospective? It would inject table name and all, which I believe you can't bind...