escape identifiers in queries

apps/files/appinfo/update.php

 <?php
 
-// fix webdav properties,add namespace in front of the property, update for OC4.5
-$installedVersion=OCP\Config::getAppValue('files', 'installed_version');
-if (version_compare($installedVersion, '1.1.6', '<')) {
-	$query = OC_DB::prepare( "SELECT propertyname, propertypath, userid FROM `*PREFIX*properties`" );
-	$result = $query->execute();
+// fix webdav properties,add namespace in front of the property, update for OC4.5
+$installedVersion=OCP\Config::getAppValue('files', 'installed_version');
+if (version_compare($installedVersion, '1.1.6', '<')) {
+	$query = OC_DB::prepare( "SELECT `propertyname`, `propertypath`, `userid` FROM `*PREFIX*properties`" );
+	$result = $query->execute();
 	while( $row = $result->fetchRow()){
-		if ( $row["propertyname"][0] != '{' ) {
-			$query = OC_DB::prepare( 'UPDATE *PREFIX*properties SET propertyname = ? WHERE userid = ? AND propertypath = ?' );
+		if ( $row["propertyname"][0] != '{' ) {
+			$query = OC_DB::prepare( 'UPDATE `*PREFIX*properties` SET `propertyname` = ? WHERE `userid` = ? AND `propertypath` = ?' );
 			$query->execute( array( '{DAV:}' + $row["propertyname"], $row["userid"], $row["propertypath"] ));
-		}
-	}
+		}
+	}
 }
 
 //update from OC 3