Why special characters are not allowed in SQL table column name?

Question

I created a table and named one of the columns as 50" the SQL accepted it but later when I right click on the table then click on "edit top 200 rows" the SQL Management studio stuck and stops working and closes.

However I still can edit other tables which don't have special characters in their column name. It sounds like the " is not allowed in column name? Any idea how can I include " in column name?

Answer 1

The reason is so people can write reasonable validation regular expressions to stop SQL injection on user supplied column names.

While more characters are allowed then you would expect, because the characters used to do SQL injection itself aren't allowed, you can simply reject user supplied data that has them without needing to worry about checking escape characters.

Don't expect escaping a quote to work in a column name. You can't get a semicolon into a column name, so you can't put in a column named "data;drop table students;--" :)