A Mysql query, with`crases` vs without

Question

With aces to query is safer or less?

$Query = "Select * from `tabela` WHERE `id` = `1`";


vs

$Query = "Select * from tabela WHERE id = 1";

Answer 1

With regard to safety, no, backticks has no involvement with security.

The backticks are used if you use any mysql reserved word or when there’s room.

The first example of the link already goes straight to the point:

mysql> CREATE TABLE interval (begin INT, end INT);
ERROR 1064 (42000): You have an error in your SQL syntax ...
near 'interval (begin INT, end INT)'

mysql> CREATE TABLE `interval` (begin INT, end INT);
Query OK, 0 rows affected (0.01 sec)

Answer 2

It depends. If you know what you’re doing, either. If you don’t know, the first is better, so you avoid conflicts that may arise and you don’t know how to resolve them. Some programmers adopt this form by default, others adopt the second form and only when it needs to use the backtick, the correct name of this, is that it uses it.

It’s no longer safe to do that, safety comes from correct practices. This helps avoid certain types of conflicts or inconsistencies, such as using characters that might confuse the syntax of query, space for example, or reserved words. If you know and organize well the names of things, it does not help much.

In some cases can help in safety and avoid SQL Injection but do not count on this to solve this problem, this measure can be circumvented. The feature was not invented to solve security problems.

It is good to know that this form is not available in all databases. If you need to use the query for another, you may have problems. But if you need this feature, you will probably have several others.