All user input need to sanitised or check agains a data structure validating that is a valid input. Especially something like table names.