Table as parameter in SQL Server

Question

I have the following stored procedure:

 ALTER procedure [dbo].[jk_insertAllLocation]
     @locationTbl as locationTable readonly,
     @TableName varchar(100)
 as
    declare @tbl as locationTable, @sql nvarchar(max)
    begin
    set @sql = N'insert into '+ @tbl + 'select * from ' + @locationTbl +
    'delete c
    from @tbl  c 
    inner join'+ @TableName + 'ON '+@TableName+ '.location_id=c.location_id'
    exec sp_executesql @sql

    set @sql= N'insert into'+ @TableName+ '(location_id,name,address,latitude,longitude,distance,state,sub_cat,id_cat,icon_link,checkinsCount,IDSearch)
    select * from '+ @tbl
    exec sp_executesql @sql

    select id,location_id from lebanon
  end

I keep getting:

Must declare the scalar variable "@tbl".
Must declare the scalar variable "@locationTbl".

and they are already declared..

I think the problem is that they are tables not string to be concatenated but I have to pass the table name as parameter @TableName and I'm using this table name in 2 separate queries using inner join and insert so how can I do that? I'm not finding anything on google

Am I missing something here?

Answer 1

Move the line where you declare those variables after the begin line. There are other problems, too, but I think this will at least change the error message to something more helpful.

Also, this scares me as potentially vulnerable to sql injection attacks.