Importance of backtick around table name in MySQL query

Question

In MySQL queries, how important is it to put backticks around a table name. Does it have something to do with security? Are MySQL injection attacks possible through the table name if the table name is created dynamically in PHP based on user inputs?

Answer 1

The backticks help you from accidentally using a name that is a reserved word in SQL for example. Take a table named "where", it's a stupid name for a table I agree, but if you wrap it in backticks it will work fine.

Answer 2

In MySQL queries, how important is it to put backticks around a table name. Does it have something to do with security?

As far as backticks are concerned, I use them when there is name conflict between mysql-specifcs names and those from query.

Are MySQL injection attacks possible through the table name if the table name is created dynamically in PHP based on user inputs?

When ever there is a user input, you need to make sure that you filter and validate the input coming from the user. So yes there is security risk to it.

I would recommend you to use intval for numbers and mysql_real_escape_string function for any variables that you may use in your queries.