[BUGFIX] Fix SQL Injection possibilities

Table name is fetched from GET parameters and
passed directly to a database query.

This change checks the table name against a whitelist
(TCA) and throws an exception if the table name does
not exist.

Additionally another value passed by GET is sanitized
to integer before using in SQL string