Sometimes you do have to concatenate strings to make SQL statements. You must of course be very careful under such circumstances. Variable table names are one such situation.
You should probably in this case use a built-in like
quoteIdentifier to ensure you cope with all necessary circumstances.
I would also in addition add a restriction on the allowable characters:
Yes, that limits table names beyond what the underlying RDBMS supports.
Do you have a requirement to support table names with spaces in them? Or is it acceptable to forbid special characters in table names? If you can, do so.
"Just do it right instead of asking whether doing it wrong is safe".
Since you are reviewing code, this is the comment to the coder.