dbo.sp_GetFullNameFromTableSanitized.sql

CREATE PROCEDURE dbo.sp_GetFullNameFromTableSanitized
	@ParmTableName varchar(100),
	@ParmUserName varchar(100)
AS
BEGIN
	DECLARE @FullQuery nvarchar(1000)
	SET @FullQuery = N'SELECT FullName FROM dbo.' + QUOTENAME(@ParmTableName) + ' WHERE UserName = @UserName'

	DECLARE @ParmDefinition nvarchar(100) = N'@UserName varchar(100)';  

	EXEC sp_executesql @FullQuery, @ParmDefinition,  
					  @UserName = @ParmUserName

END