escape mysql column name with `

There is a bug when trying to update  fields like "key, password, ...". The update function does not escape the field name.