允许参数化SQL查询的哪些部分？(What parts of a SQL query are allowed to be parameterized?)

 例如，通常允许这样做： 
 
sql.execute("select * from some_table where some_column=@parameter", parameter=5);
 
 但不是这个： 
 
sql.execute("select * from @which_table where some_column=5", which_table="some_table");
 
 没有测试所有可能的组合......是这样的： 
 
sql.execute("select @which_column from some_table", which_column="some_column");
 
 或这个： 
 
sql.execute("select some_column*@multiplier from some_table", multipler=5);
 
 要么.... 
 
 确定查询的某些部分是否可参数化的一般规则是什么？为什么？ 
 
 （我意识到对于不同语言的不同数据库引擎和适配器，这可能有不同的答案，但我注意到有一般趋势） 

For instance, this is generally allowed:
 
sql.execute("select * from some_table where some_column=@parameter", parameter=5);
 
But not this:
 
sql.execute("select * from @which_table where some_column=5", which_table="some_table");
 
Having not tested all possible combinations.... Is this:
 
sql.execute("select @which_column from some_table", which_column="some_column");
 
Or this:
 
sql.execute("select some_column*@multiplier from some_table", multipler=5);
 
Or....
 
What is the general rule for determining whether some part of a query is parameterizable, and why?
 
(I realize that this may have different answers with respect to different DB engines and adapters for different languages, but I've noticed that there are general trends)

原文：https://stackoverflow.com/questions/44315421