I have a Python script executing DB2 query as
select count(*) as num_rows from {table}

The value of {table} is read from a list of tables and I need to print out the count corresponding to each table. However that SQL statement is reported for SQL injection vulnerability. Now I can parameterize the value part of a SQL statement, but how do I take tablename as a parameter to resolve the SQL injection issue?

I tried filtering the “table” input using shlex as
table = shlex.quote(table)
and then passing it on to the SQL query but it doesn’t help