[sheeshkebab]

Is that safe from sqli prospective? It would inject table name and all, which I believe you can't bind...

[ksri]

You're right. That's why I said upfront - whitelist values in the userquery object.