thelia/thelia — pull request #916 by lovenunu (2014-11-24 08:22:46+00:00)
Title: Add filter table name on database backup

This is an answer to #910, you can't bind a table name with PDO as it will quote the string.
For instance, if you do:

```php
prepare('SELECT * FROM ?');
$stmt->bindValue(1, $table);
$stmt->execute();
```

You'll get the SQL Error:
```
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''accessory'' at line 1
```
As it will try to execute:
```sql
SELECT * FROM 'accessory';
```

A solution would be to filter the tablename ourself in the loop.
Here, the allowed characters are ```a-zA-Z0-9_-```