Java – SQL prepared statement for creating tables

I want to know some methods of dynamically creating tables based on user input (SQL prepared statement)

CREATE TABLE ? (
  First_Name char(50),Last_Name char(50)
)

What should I use instead of a question mark

Solution

Preparedstatement placeholders do not apply to table or column names, they are only used for actual column values

Therefore, you must dynamically create (prepared) statement strings, which means that your application will be vulnerable to SQL injection attacks Depending on how the application should be used – and by whom – this can be a big problem

Related issues

> How do I sanitize SQL without using prepared statements