The functionality of auto-completion of table names with prefixes in the text of queries to the database?

Question

PHP

Many systems use the functionality of auto-completion of table names with prefixes in the text of queries to the database. It is assumed that this should work like this: if we need to execute a query and automatically complete the table names in it with prefixes used in the system, then in the query text we simply frame the table name in the query text in a special way. The most commonly used syntax is {table_name} .
Actually, everything would be fine, but the following question haunts me: if in the query text there are frame symbols that are not associated with the table name, then how to avoid replacing them?
Maybe I just misunderstood the work of the add-on functions, but let's take, for example, the db_prefix_tables function from the common Drupal CMS :

function db_prefix_tables($sql) {
  global $db_prefix;

  if (is_array($db_prefix)) {
    if (array_key_exists('default', $db_prefix)) {
      $tmp = $db_prefix;
      unset($tmp['default']);
      foreach ($tmp as $key => $val) {
        $sql = strtr($sql, array('{'. $key .'}' => $val . $key));
      }
      return strtr($sql, array('{' => $db_prefix['default'], '}' => ''));
    }
    else {
      foreach ($db_prefix as $key => $val) {
        $sql = strtr($sql, array('{'. $key .'}' => $val . $key));
      }
      return strtr($sql, array('{' => '', '}' => ''));
    }
  }
  else {
    return strtr($sql, array('{' => $db_prefix, '}' => ''));
  }
}

Suppose the input is a request to add a line of the form:

INSERT INTO {table} VALUES(1, 'username', '}{aKeP')

At the output we get:

INSERT INTO PREFIX_table VALUES(1, 'username', 'PREFIX_aKeP')

What's the catch? How to avoid it?

Answer 1

additionally process the transmitted data with the htmlspecialchars function.