Use Propel::getDB() to find adapter using by  and use quoteIdentifier() from adapter to protect fieldnames and tablenames.