php/php-src — pull request #167 by vrana (2012-08-19 01:05:21+00:00)
Title: Add PDO::quoteName() method

Includes MySQL, SQLite, PgSQL, Firebird, Oracle and MS SQL implementations.

This method allows creating higher level libraries building the SQL command with proper escaping of identifiers. For example `$db->select('id', 'title')->from('article')->where('id', $id)`.

It also allows using user input for table or column names: `'SELECT * FROM t ORDER BY ' . $pdo->quoteName($_GET['order'])` can cause SQL error but it couldn't cause SQL injection.