PreparedStatement should be initialised with ? for the table name, then setString should be invoked to add the table name

This apparently cannot be done for table names.
https://stackoverflow.com/questions/11312155/how-to-use-a-tablename-variable-for-a-java-prepared-statement-insert

A reasonable thing to do might be to:

1. Retrieve all table names from the db connection
2. Check that the user submitted table name matches a table from the db
3. Signal an error if not

That's a good idea! Maybe this can be done in the SQLReader constructor storing the list of tables as a private variable. In any case, we can create a separate issue for this problem mentioning also other security concerns due to the fact that a custom SQL query can be provided