c# - Sql parameter are not getting replaced -

i trying create new table in databased based on csv file. since don't know columns in csv file creating sqlcommand @ runtime. here have far.

public static void addtablefromfile(string file) {     defaultcontext dbcontext = defaultcontext.getinstance();     dbproviderfactory dbfactory = dbproviderfactories.getfactory(dbcontext.database.connection);      sqlcommand createtable = new sqlcommand();     createtable.connection = (sqlconnection)dbcontext.database.connection;      //get fields file.     textreader reader = file.opentext(file);     string head = reader.readline();     reader.close();     head = head.replace('\"', ' ');      //build column paramaters sql query.     string[] fields = head.split(',');     if (fields.length == 0)         throw new exception("no data process; " + file);     stringbuilder columnsbuilder = new stringbuilder();     (int = 0; < fields.count(); i++)     {          columnsbuilder.append("@column" + + " char(25), ");          createtable.parameters.addwithvalue("@column" + i, fields[i]);     }     //make first field primary key.     columnsbuilder.append("primary key(@column0)");      createtable.parameters.addwithvalue("@tablename", path.getfilenamewithoutextension(file));      createtable.commandtext = "create table @tablename (" + columnsbuilder.tostring() + ")";      dbcontext.database.connection.open();     createtable.executenonquery();     dbcontext.database.connection.close();      defaultcontext.release();     logger.log("table " + path.getfilenamewithoutextension(file) + " added database."); } 

however everytime runs sqlexception telling me there syntax error around @tablename. have tried same command putting raw values in string, know works. missing obvious here?

just in case helps, working mvc 4 , believe database sql server express or whichever 1 comes bundled visual studio 2012.

am missing obvious here?

unfortunately, think you're missing unsupported. while values can parameterized, databases (including sql server) don't allow table names or field names parameterized, far i'm aware.

so basically, if need able accept fields etc user input, you'll need go through work of being super-careful accepted characters, escaping value etc - , put sql directly.