You could try to use prepared statements
first :
SET @sql = CONCAT("INSERT INTO TABLE ",tblname," VALUES('",string,"')");
PREPARE stmnt FROM @sql;
EXECUTE stmnt;