Use placeholder to avoid sqli and properly quote table name