{"record":{"id":"e37bf1a147333e97","repo":"quarkusio/quarkus","slug":"sort-column-name-cannot-have-backticks","errorCode":null,"errorMessage":"Sort column name cannot have backticks","messagePattern":"Sort column name cannot have backticks","errorType":"exception","errorClass":"PanacheQueryException","httpStatus":null,"severity":"error","filePath":"extensions/panache/panache-hibernate-common/runtime/src/main/java/io/quarkus/panache/hibernate/common/runtime/PanacheJpaUtil.java","lineNumber":302,"sourceCode":"        for (int j = 0; j < path.length; j++) {\n            if (j > 0)\n                sb.append('.');\n            sb.append('`').append(unquoteColumnName(path[j])).append('`');\n        }\n        return sb;\n    }\n\n    private static String unquoteColumnName(String columnName) {\n        String unquotedColumnName;\n        //Note HQL uses backticks to escape/quote special words that are used as identifiers\n        if (columnName.charAt(0) == '`' && columnName.charAt(columnName.length() - 1) == '`') {\n            unquotedColumnName = columnName.substring(1, columnName.length() - 1);\n        } else {\n            unquotedColumnName = columnName;\n        }\n        // Note we're not dealing with columns but with entity attributes so no backticks expected in unquoted column name\n        if (unquotedColumnName.indexOf('`') >= 0) {\n            throw new PanacheQueryException(\"Sort column name cannot have backticks\");\n        }\n        return unquotedColumnName;\n    }\n}\n","sourceCodeStart":284,"sourceCodeEnd":307,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/panache/panache-hibernate-common/runtime/src/main/java/io/quarkus/panache/hibernate/common/runtime/PanacheJpaUtil.java#L284-L307","documentation":"PanacheJpaUtil.unquoteColumnName strips surrounding quotes/backticks from a sort/column name and then rejects any remaining backticks. Because Panache sorts reference entity attributes (not raw SQL columns), backtick-quoted identifiers are not supported inside an unquoted name, so it throws PanacheQueryException to prevent invalid HQL generation. It is typically reached via escapeColumnName when processing a Sort passed to Panache.find/list.","triggerScenarios":"Calling Panache.find/list with Sort.by(\"`column`\") where the inner name still contains backticks, or sorting by a name wrapped inconsistently such as \"`name\" or containing backticks mid-string, e.g. Sort.descending(\"`field`\").","commonSituations":"Copy-pasting SQL column quoting into Panache sorts; double-quoting a column that was already quoted so the unquote step leaves inner backticks; building sort names dynamically from DDL metadata that includes backticks (MySQL-style quoting).","solutions":["Remove backticks from the sort property name: use Sort.by(\"name\") not Sort.by(\"`name`\")","Pass the entity attribute name (Java field name), not the database column name","If the DB column differs from the attribute, use @Column mapping and sort by the attribute name","Sanitize dynamically built sort names with columnName.replace(\"`\", \"\") before creating the Sort"],"exampleFix":"// before\nquery.sort(Sort.by(\"`created_at`\"));\n\n// after\nquery.sort(Sort.by(\"createdAt\")); // entity attribute name","handlingStrategy":"validation","validationCode":"Sort safeSort(String attr, Sort.Direction dir) {\n    String clean = attr.replace(\"`\", \"\").replace(\"\\\"\", \"\").trim();\n    return dir == Sort.Direction.DESC ? Sort.descending(clean) : Sort.ascending(clean);\n}","typeGuard":"boolean isSafeSortColumn(String name) {\n    return name != null && !name.contains(\"`\") && !name.isBlank();\n}","tryCatchPattern":"try {\n    query.sort(Sort.by(userColumn));\n} catch (PanacheQueryException e) {\n    throw new IllegalArgumentException(\"Unsupported sort column: \" + userColumn, e);\n}","preventionTips":["Always sort by entity attribute names, not SQL column names","Sanitize user-supplied sort inputs by stripping quote characters","Whitelist allowed sort fields instead of accepting arbitrary strings","Avoid copy-pasting quoted identifiers from native SQL into Panache Sort"],"tags":["panache","jpa","sort","validation"],"backgroundTag":"illegal-identifier-characters","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}