CODEWITHSUNDEEP
phpmysql
Brian
Brian

Reputation: 27392

Importance of backtick around table name in MySQL query

In MySQL queries, how important is it to put backticks around a table name. Does it have something to do with security? Are MySQL injection attacks possible through the table name if the table name is created dynamically in PHP based on user inputs?

Upvotes: 16

Views: 6429

Answers (3)

Sarfraz
Sarfraz

Reputation: 382696

In MySQL queries, how important is it to put backticks around a table name. Does it have something to do with security?

As far as backticks are concerned, I use them when there is name conflict between mysql-specifcs names and those from query.

Are MySQL injection attacks possible through the table name if the table name is created dynamically in PHP based on user inputs?

When ever there is a user input, you need to make sure that you filter and validate the input coming from the user. So yes there is security risk to it.

I would recommend you to use intval for numbers and mysql_real_escape_string function for any variables that you may use in your queries.

Upvotes: 11

Bjorn
Bjorn

Reputation: 71850

The backticks help you from accidentally using a name that is a reserved word in SQL for example. Take a table named "where", it's a stupid name for a table I agree, but if you wrap it in backticks it will work fine.

Upvotes: 20

Graham Edgecombe
Graham Edgecombe

Reputation: 3803

If you have a table name with the same name as a keyword, e.g. select, the following query will still work:

select * from `select`;

Upvotes: 3

Related Questions