Back to all patterns
SQL Identifier Validation
Validation
Validates SQL identifiers (table names, column names): letters, digits, and underscores, not starting with a digit.
/^[a-zA-Z_][a-zA-Z0-9_]*$/How it works
Standard SQL identifiers start with a letter or underscore and contain only letters, digits, and underscores. This pattern validates unquoted identifiers.
Test Cases
Should Match
- users
- user_id
- _temp
- OrderItems
Should NOT Match
- 1invalid
- has-hyphen
- has space
- has.dot
Quick Summary
Validates SQL unquoted identifiers (table names, column names, aliases): letters, digits, and underscores only, must start with a letter or underscore. Always use parameterized queries, never interpolate identifiers from user input.
Key Takeaways
Key Takeaways
- Must start with a letter or underscore, not a digit
- Only letters, digits, and underscores allowed
- SQL keywords (SELECT, FROM) are technically valid identifiers but should be avoided
- Always use parameterized queries or a whitelist to prevent SQL injection
Use Cases
When to use it
- Validating dynamic table or column names before use in SQL queries
- Checking identifier names in ORM model definitions
- Linting database migration scripts
Watch out
Common Mistakes
- Using dynamic identifiers in SQL without validation, always whitelist or quote identifiers
- Assuming this covers all SQL dialects, MySQL uses backticks, PostgreSQL uses double quotes
FAQ
SQL Identifier Validation, Frequently Asked
How do I safely use dynamic column names in SQL?
Validate against a whitelist of known column names. Never interpolate user input directly into SQL identifiers.
Are SQL identifiers case-sensitive?
It depends on the database. PostgreSQL folds unquoted identifiers to lowercase. MySQL is case-sensitive on Linux.