Properly avoid SQL injection

According to MSDN error Invalid descriptor index is returned if the parameter is part of the SELECT list.

I'm trying to execute a query

SELECT obect_id(?);

and getting this error.

However the parameter is not really part of the SELECT list.

So how to properly avoid hardcoding the parameter in this case?

I want to query the table id from SQL Server.

Or I will have to hardcode the table name?