How to make this SELECT looks better?

I've created a function that will return an specific value based on parameters.

The function is:

returnRecordSetWithParameters(tableName, columnName, columnValue) {

  // some scripts here

 }

The parameters are:

tableName = FPW_Companies

columnName = sCompany_Name

columnValue = Company

The SELECT that I need is:

SELECT * FROM FPW_Companies WHERE sCompany_Name = "Company";

The only way I got to do this SELECT with those generic parameters is like this:

"SELECT * FROM " +tableName+ " WHERE " +columnName + " = " + "'" + columnValue + "';"

That is terrible! Worked, but it is hard to do and easy to make mistakes.

Is there a easier way to do that?

Like on Java using StringBuilder or PreparedStatement.

Thx!