Fixed #7918: SQL injection
dev: array is allowed when not one of the reserved words