What causes "Invalid table name" in FlowiseAI/Flowise?

Pre-normalize the name: replace every char outside [a-z0-9_] with '_' before calling.

FlowiseAI/Flowise · error · Error

Invalid table name

Error message

Invalid table name

What it means

sanitizeRecordManagerTableName normalizes input (trim, lowercase, collapse whitespace to underscore) then requires the result to match ^[a-zA-Z0-9_]+$. Any character that is not an ASCII letter, digit, or underscore after normalization throws 'Invalid table name'. This is stricter than namespace validation: hyphens and dots are rejected because the value becomes a SQL identifier used in raw SQL by the record manager.

Source

Thrown at packages/components/src/recordManagerSecurity.ts:11

export const RECORD_MANAGER_TABLE_NAME_MAX_LENGTH = 128
export const RECORD_MANAGER_NAMESPACE_MAX_LENGTH = 128

/**
 * Validates record manager table names used in SQL identifiers.
 */
export function sanitizeRecordManagerTableName(tableName: string): string {
    tableName = tableName.trim().toLowerCase().replace(/\s+/g, '_')

    if (!/^[a-zA-Z0-9_]+$/.test(tableName)) {
        throw new Error('Invalid table name')
    }

    if (tableName.length > RECORD_MANAGER_TABLE_NAME_MAX_LENGTH) {
        throw new Error(`Invalid table name: must be at most ${RECORD_MANAGER_TABLE_NAME_MAX_LENGTH} characters`)
    }

    return tableName
}

/**
 * Validates record manager namespace values stored in the database.
 */
export function sanitizeRecordManagerNamespace(namespace: string): string {
    const trimmed = namespace.trim()

    if (!/^[a-zA-Z0-9_-]{1,128}$/.test(trimmed)) {
        throw new Error('Invalid namespace')
    }

View on GitHub (pinned to abe4a8601a)

Solutions

Pre-normalize the name: replace every char outside [a-z0-9_] with '_' before calling.
Use only lowercase alphanumerics and underscores as the naming convention.
Reject empty input upstream so trim() never yields ''.

Example fix

// before
sanitizeRecordManagerTableName('My-Bedrock.Table') // throws 'Invalid table name'

// after
const safe = 'My-Bedrock.Table'.toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '')
sanitizeRecordManagerTableName(safe) // 'my_bedrock_table'

Defensive patterns

Strategy: validation

Validate before calling

import { RECORD_MANAGER_TABLE_NAME_MAX_LENGTH } from './recordManagerSecurity'

function toValidTableName(raw: string): string | null {
  const n = raw.trim().toLowerCase().replace(/\s+/g, '_').replace(/[^a-z0-9_]/g, '_')
  if (!n || n.length > RECORD_MANAGER_TABLE_NAME_MAX_LENGTH) return null
  return n
}

Type guard

const isValidTableName = (s: string): boolean => /^[a-zA-Z0-9_]+$/.test(s.trim().toLowerCase().replace(/\s+/g, '_'))

Try / catch

try {
  return sanitizeRecordManagerTableName(input)
} catch (e) {
  throw new Error(`Table name '${input}' is invalid: ${(e as Error).message}`, { cause: e })
}

Prevention

Restrict user-facing table-name inputs to [a-z0-9_] at the UI layer.
Replace disallowed characters with '_' before calling sanitizeRecordManagerTableName.
Remember hyphens and dots are allowed for namespaces but NOT for table names.

When it happens

Trigger: Passing 'my-table' (hyphen), 'db.table' (dot), 'order$' ($), '' (empty after trim), 'café' (unicode), or any quoted/whitespace-only string.

Common situations: Deriving the table name from a free-form project/org/tenant display name; users assuming the same rules as namespaces (which allow hyphens); concatenating names with '-' or '.' separators.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/d133fb8ef2ab70a2. Report an issue: GitHub.