title: Is there any safe way to parameterize database names in MySQL queries?
body: <p>I'm writing a little python script to help me automate the creation of mysql databases and associated accounts for my personal projects. Part of this script is a function that takes the database name as a string, then goes to create the database. </p>
  
  <pre><code>def createDB(dbConn, dbName):
      import MySQLdb
      c = dbConn.cursor()
      query = """CREATE DATABASE %s;""";
      c.execute(query, (dbName,))
  </code></pre>
  
  <p>This doesn't work because <a href="http://dev.mysql.com/doc/refman/5.0/en/create-database.html" rel="nofollow">MySQL's CREATE DATABASE</a> asks for the unquoted name of the database, as in </p>
  
  <pre><code>  CREATE DATAbASE test_db
  </code></pre>
  
  <p>but my code that attempts to safely insert the user provided db name into the query creates:</p>
  
  <pre><code>  CREATE DATABASE 'test_db'
  </code></pre>
  
  <p>And you get "you have a problem in your MySQL syntax near test".</p>
  
  <p>Even though this is for personal use, I really don't want to just directly insert a user provided string into a query of any kind. Its against my religion. Is there a safe way to insert a user-provided database name into a mySQL query in python (or any language) that will make sure that user input such as <code>test_db; DROP some_other_db;</code> will get rejected or escaped correctly?</p>