commit 7ae47c682400a3abb7ee08f2aa47ff39d0f5d92f
Author: Chris Rockwell <chris@chrisrockwell.com>
Date:   Thu Jun 14 13:49:15 2012 -0400

    Escaping tables and field names when mysql is db

diff --git a/core/includes/database/mysql/database.inc b/core/includes/database/mysql/database.inc
index e024a7f..2a48bcb 100644
--- a/core/includes/database/mysql/database.inc
+++ b/core/includes/database/mysql/database.inc
@@ -97,7 +97,53 @@ class DatabaseConnection_mysql extends DatabaseConnection {
   public function databaseType() {
     return 'mysql';
   }
+	
+  /**
+   * Escapes a table name string.
+   *
+   * Force all table names to be strictly alphanumeric-plus-underscore period and space.
+	 * If table name passed is enclosed in backticks add them back on before returning
+   * For some database drivers, it may also wrap the table name in
+   * database-specific escape characters.
+   *
+   * @return
+   *   The sanitized table name string.
+   */
+  public function escapeTable($table) {
+    $escaped = preg_replace('/[^A-Za-z0-9_. ]+/', '', $table);
+    if (stripos($escaped, '.') !== FALSE) {
+			$escaped = '`' . str_replace('.', '`.`', $escaped) . '`';
+		} 
+		else {
+		  $escaped = '`' . $escaped . '`';
+		}
+    return $escaped;
+  }
 
+  /**
+   * Escapes a field name string.
+   *
+   * Force all field names to be strictly alphanumeric-plus-underscore period and space.
+	 * If field name passed is enclosed in backticks add them back on before returning
+   * For some database drivers, it may also wrap the field name in
+   * database-specific escape characters.
+   *
+   * @return
+   *   The sanitized field name string.
+   */
+  public function escapeField($field) {
+    $escaped = preg_replace('/[^A-Za-z0-9_. ]+/', '', $field);
+		// account for table.field scenario 
+		// (explicitly check for false may not be needed as it can not start with .)
+		if (stripos($escaped, '.') !== FALSE) {
+			$escaped = '`' . str_replace('.', '`.`', $escaped) . '`';
+		} 
+		else {
+		  $escaped = '`' . $escaped . '`';
+		}
+    return $escaped;
+  }
+	
   public function mapConditionOperator($operator) {
     // We don't want to override any of the defaults.
     return NULL;
diff --git a/core/includes/database/mysql/query.inc b/core/includes/database/mysql/query.inc
index 888b6a5..df90e93 100644
--- a/core/includes/database/mysql/query.inc
+++ b/core/includes/database/mysql/query.inc
@@ -40,14 +40,63 @@ class InsertQuery_mysql extends InsertQuery {
 
     return $last_insert_id;
   }
-
+  /**
+   * Escapes a field name string.
+   *
+   * Force all field names to be strictly alphanumeric-plus-underscore period and space.
+	 * If field name passed is enclosed in backticks add them back on before returning
+   * For some database drivers, it may also wrap the field name in
+   * database-specific escape characters.
+   *
+   * @return
+   *   The sanitized field name string.
+   */
+  public function escapeField($field) {
+    $escaped = preg_replace('/[^A-Za-z0-9_. ]+/', '', $field);
+		// account for table.field scenario 
+		// (explicitly check for false may not be needed as it can not start with .)
+		if (stripos($escaped, '.') !== FALSE) {
+			$escaped = '`' . str_replace('.', '`.`', $escaped) . '`';
+		} 
+		else {
+		  $escaped = '`' . $escaped . '`';
+		}
+    return $escaped;
+  }
+	 /**
+   * Escapes a table name string.
+   *
+   * Force all table names to be strictly alphanumeric-plus-underscore period and space.
+	 * If table name passed is enclosed in backticks add them back on before returning
+   * For some database drivers, it may also wrap the table name in
+   * database-specific escape characters.
+   *
+   * @return
+   *   The sanitized table name string.
+   */
+  public function escapeTable($table) {
+    $escaped = preg_replace('/[^A-Za-z0-9_. ]+/', '', $table);
+    if (stripos($escaped, '.') !== FALSE) {
+			$escaped = '`' . str_replace('.', '`.`', $escaped) . '`';
+		} 
+		else {
+		  $escaped = '`' . $escaped . '`';
+		}
+    return $escaped;
+  }
   public function __toString() {
     // Create a sanitized comment string to prepend to the query.
     $comments = $this->connection->makeComment($this->comments);
-
+		
     // Default fields are always placed first for consistency.
     $insert_fields = array_merge($this->defaultFields, $this->insertFields);
-
+		// add backticks to fields
+		foreach ($insert_fields as $field) {
+			$__if[] = $this->escapeField($field);
+		}
+		$insert_fields = $__if;
+		// add backticks to table
+		$this->table = $this->escapeTable($this->table);
     // If we're selecting from a SelectQuery, finish building the query and
     // pass it back, as any remaining options are irrelevant.
     if (!empty($this->fromQuery)) {
@@ -81,7 +130,6 @@ class InsertQuery_mysql extends InsertQuery {
     }
 
     $query .= implode(', ', $values);
-
     return $query;
   }
 }