Parameterize or fail

SQL injection is string concatenation meeting user input. Implement static string BuildQuery(string tableName, string userInput) that returns a SAFE parameterized-style SQL text: "SELECT * FROM " + validated table + " WHERE name = @name" — validating the table against an allow-list {"orders", "customers"} (throw ArgumentException otherwise) and NEVER embedding userInput into the string (@name stays a placeholder). Implement static bool IsSafeQuery(string sql) that returns false if the sql contains a quote character (proof that user data was interpolated).