fuel/fuel/core/classes/database/connection.php
public function quote_identifier($value)
	{
		if ($value === '*')
		{
			return $value;
		}
		elseif (is_object($value))
		{
			if ($value instanceof Database_Query)
			{
				// Create a sub-query
				return '('.$value->compile($this).')';
			}
			elseif ($value instanceof Database_Expression)
			{
				// Use a raw expression
				return $value->value();
			}
			else
			{
				// Convert the object to a string
				return $this->quote_identifier((string) $value);
			}
		}
		elseif (is_array($value))
		{
			// Separate the column and alias
			list ($value, $alias) = $value;

			return $this->quote_identifier($value).' AS '.$this->quote_identifier($alias);
		}

		if (preg_match('/^(["\']).*\1$/m', $value))
		{
			return $value;
		}

		if (strpos($value, '.') !== false)
		{
			// Split the identifier into the individual parts
			// This is slightly broken, because a table or column name
			// (or user-defined alias!) might legitimately contain a period.
			$parts = explode('.', $value);

			if ($prefix = $this->table_prefix())
			{
				// Get the offset of the table name, 2nd-to-last part
				// This works for databases that can have 3 identifiers (Postgre)
				$offset = count($parts) - 2;

				// Add the table prefix to the table name
				$parts[$offset] = $prefix.$parts[$offset];
			}

			// Quote each of the parts
			return implode('.', array_map(array($this, __FUNCTION__), $parts));
		}

		// That you can simply escape the identifier by doubling
		// it is a built-in assumption which may not be valid for
		// all connection types!  However, it's true for MySQL,
		// SQLite, Postgres and other ANSI SQL-compliant DBs.
		return $this->_identifier.str_replace($this->_identifier, $this->_identifier.$this->_identifier, $value).$this->_identifier;
	}
public function quote_identifier($value)
	{
		if ($value === '*')
		{
			return $value;
		}
		elseif (is_object($value))
		{
			if ($value instanceof Database_Query)
			{
				// Create a sub-query
				return '('.$value->compile($this).')';
			}
			elseif ($value instanceof Database_Expression)
			{
				// Use a raw expression
				return $value->value();
			}
			else
			{
				// Convert the object to a string
				return $this->quote_identifier((string) $value);
			}
		}
		elseif (is_array($value))
		{
			// Separate the column and alias
			list ($value, $alias) = $value;

			return $this->quote_identifier($value).' AS '.$this->quote_identifier($alias);
		}

		if (preg_match('/^(["\']).*\1$/m', $value))
		{
			return $value;
		}

		if (strpos($value, '.') !== false)
		{
			// Split the identifier into the individual parts
			// This is slightly broken, because a table or column name
			// (or user-defined alias!) might legitimately contain a period.
			$parts = explode('.', $value);

			if ($prefix = $this->table_prefix())
			{
				// Get the offset of the table name, 2nd-to-last part
				// This works for databases that can have 3 identifiers (Postgre)
				$offset = count($parts) - 2;

				// Add the table prefix to the table name
				$parts[$offset] = $prefix.$parts[$offset];
			}

			// Quote each of the parts
			return implode('.', array_map(array($this, __FUNCTION__), $parts));
		}

		// That you can simply escape the identifier by doubling
		// it is a built-in assumption which may not be valid for
		// all connection types!  However, it's true for MySQL,
		// SQLite, Postgres and other ANSI SQL-compliant DBs.
		return $this->_identifier.str_replace($this->_identifier, $this->_identifier.$this->_identifier, $value).$this->_identifier;
	}
public function quote_identifier ( $ value ) { if ( $ value === '*' ) { return $ value ; } elseif ( is_object ( $ value ) ) { if ( $ value instanceof Database_Query ) { // Create a sub-query return '(' . $ value -> compile ( $ this ) . ')' ; } elseif ( $ value instanceof Database_Expression ) { // Use a raw expression return $ value -> value ( ) ; } else { // Convert the object to a string return $ this -> quote_identifier ( ( string ) $ value ) ; } } elseif ( is_array ( $ value ) ) { // Separate the column and alias list ( $ value , $ alias ) = $ value ; return $ this -> quote_identifier ( $ value ) . ' AS ' . $ this -> quote_identifier ( $ alias ) ; } if ( preg_match ( '/^(["\']).*\1$/m' , $ value ) ) { return $ value ; } if ( strpos ( $ value , '.' ) !== false ) { // Split the identifier into the individual parts // This is slightly broken, because a table or column name // (or user-defined alias!) might legitimately contain a period. $ parts = explode ( '.' , $ value ) ; if ( $ prefix = $ this -> table_prefix ( ) ) { // Get the offset of the table name, 2nd-to-last part // This works for databases that can have 3 identifiers (Postgre) $ offset = count ( $ parts ) - 2 ; // Add the table prefix to the table name $ parts [ $ offset ] = $ prefix . $ parts [ $ offset ] ; } // Quote each of the parts return implode ( '.' , array_map ( array ( $ this , __FUNCTION__ ) , $ parts ) ) ; } // That you can simply escape the identifier by doubling // it is a built-in assumption which may not be valid for // all connection types!  However, it's true for MySQL, // SQLite, Postgres and other ANSI SQL-compliant DBs. return $ this -> _identifier . str_replace ( $ this -> _identifier , $ this -> _identifier . $ this -> _identifier , $ value ) . $ this -> _identifier ; }
Quote a database identifier, such as a column name. Adds the
table prefix to the identifier if a table name is present.

$column = $db->quote_identifier($column);

You can also use SQL methods within identifiers.

// The value of "column" will be quoted
$column = $db->quote_identifier('COUNT("column")');

Objects passed to this function will be converted to strings.
[Database_Expression] objects will use the value of the expression.
[Database_Query] objects will be compiled and converted to a sub-query.
All other objects will be converted using the `__toString` method.

@param   mixed $value any identifier

@return  string

@uses    static::table_prefix
Quote a database identifier such as a column name . Adds the table prefix to the identifier if a table name is present .