What an awkward problem. :(

Ideally we should use a different name format to ensure it's always a
valid identifier, but I can't see how we'd solve the compat then.

Still, I'm not so sure it's wise to let get_my_table() start to quote
the returned table name though; it only works as long as the caller only
inserts it directly into an sql query, and doesn't do the backtick
quoting himself. We cannot assume that.

What we can do is fix the backticks internally in DBManager etc, and
document it. One could consider new alternative functions that return
quoted names, but I don't think that really improves anything since the
quoting is very easy to do anyway.

Is there anything else that can be done about this mess?

Thomas Gusenleitner <[email protected]> wrote:

> in Roxen  the table names from get_my_table() and related functions
> should be escaped with `. Because the table names are sometimes
> starting with digits and this will produce invalid sql statements.

Reply via email to