When to Use Single Quotes, Double Quotes, and Backticks in MySQL

By the end of this page, you will understand the different roles of single quotes, double quotes, and backticks in MySQL, and how they interact with PHP strings. You will also learn the safest way to include values and identifiers in queries, why prepared statements matter, and how to avoid common quoting mistakes.

In MySQL, different quote characters mean different things.

• Single quotes '...' are primarily used for string values in SQL.
• Double quotes "..." may behave like string quotes in MySQL by default, but their behavior can change depending on SQL modes. Because of that, they are usually not the preferred choice for portable SQL string literals.
• Backticks `...` are used for identifiers, such as table names and column names.

This matters because SQL needs to distinguish between:

• data values: things like 'Alice', 'hello', '2025-01-01'
• identifiers: names like users, email, order
• SQL keywords: things like SELECT, INSERT, FROM

For example:

INSERT INTO `users` (`name`, `email`) VALUES ('Alice', 'a@example.com');

Here:

• `users`, `name`, and `email` are identifiers
• 'Alice' and 'a@example.com' are string values

Why this matters in real programming

Using the right quotes makes your SQL:

• easier to read
• less error-prone
• more compatible across environments
• safer when combined with prepared statements

A very important rule is this:

• Values should usually be passed through prepared statements, not manually quoted.
• Identifiers cannot usually be parameterized, so if table or column names come from variables, they must be validated carefully against an allowed list.

In PHP, there is an extra layer: you are writing an SQL string inside a PHP string. That means you must think about both:

1. PHP string syntax
2. SQL quoting rules

Example:

$sql = "SELECT * FROM `users` WHERE `name` = ?";

• The outer "..." is a PHP string.
• The backticks and ? are part of the SQL.
• The actual value for name is supplied separately when executing the statement.

Think of SQL like filling out a form with three different kinds of labels:

• Backticks are for the names of boxes on the form: table names and column names.
• Single quotes are for the actual text you put inside the boxes.
• Double quotes are confusing in MySQL because they may sometimes act like single quotes, but not always. That is why many developers avoid them in SQL values.

A simple way to remember it:

• Backticks name things
• Single quotes store text
• Prepared statements insert values safely

In PHP, imagine you are putting one note inside another note:

• the outside note is the PHP string
• the inside note is the SQL query

So you must choose PHP quotes that make the SQL easy to write and read.

Core rules

1. Use single quotes for SQL string values

SELECT * FROM `users` WHERE `name` = 'Alice';

2. Use backticks for table and column names when needed

SELECT `id`, `name` FROM `users`;

Backticks are especially useful when:

• an identifier matches a reserved word
• an identifier contains spaces or special characters
• you want explicit clarity

Example:

SELECT `order`, `group` FROM `sales`;

3. Avoid relying on double quotes for SQL string literals

SELECT * FROM `users` WHERE `name` = "Alice";

This may work in some MySQL setups, but it is better to prefer:

SELECT * FROM `users` WHERE `name` = 'Alice';

4. In PHP, use prepared statements for values

$pdo = new PDO($dsn, $username, $password);

$sql = "INSERT INTO `users` (`name`, `email`) VALUES (?, ?)";
$stmt = $pdo->prepare($sql);
$stmt->execute([$name, $email]);

This is the recommended approach because:

• you do not manually add quotes around values
• PHP and the database driver handle escaping safely
• it prevents SQL injection for values

Beginner-friendly example

$name = 'Alice';
$email = 'alice@example.com';

$sql = "INSERT INTO `users` (`name`, `email`) VALUES (?, ?)";
$stmt = $pdo->prepare($sql);
$stmt->execute([$name, $email]);

Explanation:

• "..." defines the PHP string
• `users`, `name`, and `email` are SQL identifiers
• ? placeholders stand in for data values
• $name and $email are sent separately, so you do not write 'Alice' manually in the SQL string

Consider this PHP example:

$table = 'users';
$name = 'Alice';
$email = 'alice@example.com';

$sql = "INSERT INTO `users` (`name`, `email`) VALUES (?, ?)";
$stmt = $pdo->prepare($sql);
$stmt->execute([$name, $email]);

What happens step by step

1. PHP stores the values in variables

• $table contains 'users'
• $name contains 'Alice'
• $email contains 'alice@example.com'

2. PHP creates the SQL string

$sql = "INSERT INTO `users` (`name`, `email`) VALUES (?, ?)";

The SQL text now contains:

INSERT INTO `users` (`name`, `email`) VALUES (?, ?)

At this stage:

• the table and column names are fixed in the SQL text
• the values are still placeholders

3. prepare() sends the query structure to MySQL

$stmt = $pdo->prepare($sql);

MySQL understands the statement pattern:

• insert into users
• use two values

4. execute() sends the actual data values

$stmt->execute([$name, $email]);

The driver sends the values safely and correctly.

So the final operation is effectively like:

INSERT INTO `users` (`name`, `email`) VALUES ('Alice', 'alice@example.com')

But you did not manually write those quotes yourself.

Why this is better than string concatenation

Broken approach:

$sql = "INSERT INTO users (name, email) VALUES ('$name', '$email')";

Problems:

• unsafe if values contain malicious input
• breaks if values contain quotes
• harder to maintain

Safe approach:

$sql = "INSERT INTO `users` (`name`, `email`) VALUES (?, ?)";
$stmt = $pdo->prepare($sql);
$stmt->execute([$name, $email]);

1. Inserting form data

When a user submits a registration form, values like name and email should be passed with prepared statements.

$sql = "INSERT INTO `users` (`name`, `email`) VALUES (?, ?)";

2. Filtering rows by text

Searching for a product name or category uses string values.

$sql = "SELECT * FROM `products` WHERE `category` = ?";

3. Working with reserved words

Some legacy databases have column names like order or group. Backticks let MySQL interpret them as identifiers.

SELECT `order`, `group` FROM `reports`;

4. Building admin tools with selectable columns

If a report lets users choose from known columns, developers often validate the chosen column against an allowed list, then place it in the SQL as an identifier.

$allowedColumns = ['name', 'email', 'created_at'];

Only validated identifiers should ever be inserted into SQL.

5. Updating records safely

$sql = "UPDATE `users` SET `email` = ? WHERE `id` = ?";

This pattern appears everywhere in APIs, dashboards, and background jobs.

In real projects, developers usually follow a few practical patterns.

Prepared statements for values

This is the default pattern for inserts, updates, deletes, and filtered selects.

$sql = "SELECT * FROM `users` WHERE `email` = ?";
$stmt = $pdo->prepare($sql);
$stmt->execute([$email]);

Validation for identifiers

Table names and column names cannot usually be bound with ? placeholders. So if an identifier comes from user input or configuration, it should be validated first.

$allowedSortColumns = ['name', 'created_at', 'email'];
$sort = in_array($sort, $allowedSortColumns, true) ? $sort : 'name';

$sql = "SELECT * FROM `users` ORDER BY `$sort`";

Guard clauses before querying

Applications often validate input before sending SQL.

if ($email === '') {
    throw new InvalidArgumentException('Email is required');
}

Explicit identifiers in shared codebases

Some teams always wrap identifiers in backticks for consistency:

SELECT `id`, `name` FROM `users`

Others only use backticks when necessary. Either style can work if the team is consistent.

Error handling around database operations

try {
    $stmt = $pdo->prepare("INSERT INTO `users` (`name`) VALUES (?)");
    $stmt->execute([$name]);
} catch (PDOException $e) {
    // log or handle the database error
}

The key idea is that real codebases separate:

• SQL structure
• dynamic values
• validation of dynamic identifiers

1. Using backticks for string values

Broken:

SELECT * FROM `users` WHERE `name` = `Alice`;

Why it is wrong:

• `Alice` is treated like an identifier, not a string value

Correct:

SELECT * FROM `users` WHERE `name` = 'Alice';

2. Using single quotes for column names

Broken:

SELECT 'name' FROM 'users';

Why it is wrong:

• 'name' and 'users' are string literals, not identifiers

Correct:

SELECT `name` FROM `users`;

Or, if quoting is not needed:

SELECT name FROM users;

3. Concatenating untrusted values into SQL

Broken:

$sql = "SELECT * FROM users WHERE name = '$name'";

Why it is dangerous:

• vulnerable to SQL injection
• breaks if $name contains quotes

Correct:

$sql = "SELECT * FROM `users` WHERE `name` = ?";
$stmt = $pdo->prepare($sql);
$stmt->execute([$name]);

4. Assuming double quotes always mean strings in MySQL

Potentially confusing:

SELECT * FROM users WHERE name = "Alice";

Why to avoid it:

• behavior can depend on MySQL SQL mode
• single quotes are the clearer standard for string literals

Better:

SELECT * FROM `users` WHERE `name` = 'Alice';

5. Trying to parameterize table names

Broken idea:

$sql = "SELECT * FROM ? WHERE `id` = ?";

Why it fails:

• placeholders are for values, not identifiers

Correct pattern:

$allowedTables = ['users', 'admins'];
$table = in_array($table, $allowedTables, true) ? $table : 'users';

$sql = "SELECT * FROM `$table` WHERE `id` = ?";
$stmt = $pdo->prepare($sql);
$stmt->execute([$id]);

PHP quotes vs SQL quotes

Manual quoting vs prepared statements

Quick rules

• Use single quotes for SQL string values: 'Alice'
• Use backticks for identifiers: `users`, `email`
• Avoid depending on double quotes for SQL strings in MySQL
• Use prepared statements for dynamic values
• Do not use placeholders for table or column names
• If identifiers are dynamic, validate them against an allowlist first

Safe pattern in PHP

$sql = "INSERT INTO `users` (`name`, `email`) VALUES (?, ?)";
$stmt = $pdo->prepare($sql);
$stmt->execute([$name, $email]);

Unsafe pattern

$sql = "INSERT INTO users (name, email) VALUES ('$name', '$email')";

Identifier examples

SELECT `id`, `name` FROM `users`;

Value examples

WHERE `name` = 'Alice'
WHERE `created_at` = '2025-05-04'

Remember

• Backticks = names
• Single quotes = text values
• Placeholders = dynamic values safely

Should I always use backticks around table and column names in MySQL?

Not always, but many teams do it for consistency. They are most important when identifiers are reserved words or contain unusual characters.

Are double quotes valid for strings in MySQL?

They may work in some MySQL configurations, but single quotes are the clearer and safer standard for string literals.

Can I use prepared statements for table names?

No. Prepared statement placeholders are for values, not identifiers like table names or column names.

What should I do if the table name comes from a variable?

Validate it against a fixed allowlist, then place the validated name into the SQL string.

Should I manually put quotes around values in prepared statements?

No. The database driver handles values for you when you execute the prepared statement.

Is this a MySQL rule or a PHP rule?

Both are involved. PHP controls how the query string is written in your code, and MySQL controls how quotes are interpreted inside the SQL.

Why are backticks not used for values?

Because backticks identify database object names, not text or numeric data.

• Prepared statements — the safest standard way to pass dynamic values into SQL queries.
• SQL injection — directly related because incorrect quoting often creates security vulnerabilities.
• PDO in PHP — commonly used to prepare and execute MySQL queries safely.
• MySQL identifiers — helps explain table names, column names, and when backticks are needed.
• String literals in SQL — directly related to single-quote usage.
• Reserved keywords in SQL — explains why identifiers sometimes need backticks.
• PHP string syntax — useful because SQL is often written inside PHP strings.