Q:

Do hard-to-guess SQL database table and column names help prevent SQL injection? 

I just met a developer who prepended every table and column name in his MYSQL databases with an underscore (e.g. _users, _name, _active).  When I questioned the practice he stated that this helps prevent SQL injection attacks - I have never come across this practice/advice before.  How does it help to prevent SQL injection attacks? 

A:

No. 
His thinking goes "If the attacker doesn't know the name of my tables, then the attacker can't mess with them."   However, you're still vulnerable to SQL injection, and the attacker can still cause arbitrary system calls, perhaps to well-known system tables.   What if he adds some SQL code that causes very long queries against a system table that bogs down your server? 
Security through obscurity is no security at all. 

A:

_this, _ here has no relation to security ,with that it can be vulnerable 
Good read 
Best way to prevent SQL injection?