quarkusio/quarkus · error · PanacheQueryException
Sort column name cannot have backticks
Error message
Sort column name cannot have backticks
What it means
PanacheJpaUtil.unquoteColumnName strips surrounding quotes/backticks from a sort/column name and then rejects any remaining backticks. Because Panache sorts reference entity attributes (not raw SQL columns), backtick-quoted identifiers are not supported inside an unquoted name, so it throws PanacheQueryException to prevent invalid HQL generation. It is typically reached via escapeColumnName when processing a Sort passed to Panache.find/list.
Source
Thrown at extensions/panache/panache-hibernate-common/runtime/src/main/java/io/quarkus/panache/hibernate/common/runtime/PanacheJpaUtil.java:302
for (int j = 0; j < path.length; j++) {
if (j > 0)
sb.append('.');
sb.append('`').append(unquoteColumnName(path[j])).append('`');
}
return sb;
}
private static String unquoteColumnName(String columnName) {
String unquotedColumnName;
//Note HQL uses backticks to escape/quote special words that are used as identifiers
if (columnName.charAt(0) == '`' && columnName.charAt(columnName.length() - 1) == '`') {
unquotedColumnName = columnName.substring(1, columnName.length() - 1);
} else {
unquotedColumnName = columnName;
}
// Note we're not dealing with columns but with entity attributes so no backticks expected in unquoted column name
if (unquotedColumnName.indexOf('`') >= 0) {
throw new PanacheQueryException("Sort column name cannot have backticks");
}
return unquotedColumnName;
}
}
View on GitHub (pinned to e1c734241f)
Solutions
- Remove backticks from the sort property name: use Sort.by("name") not Sort.by("`name`")
- Pass the entity attribute name (Java field name), not the database column name
- If the DB column differs from the attribute, use @Column mapping and sort by the attribute name
- Sanitize dynamically built sort names with columnName.replace("`", "") before creating the Sort
Example fix
// before
query.sort(Sort.by("`created_at`"));
// after
query.sort(Sort.by("createdAt")); // entity attribute name Defensive patterns
Strategy: validation
Validate before calling
Sort safeSort(String attr, Sort.Direction dir) {
String clean = attr.replace("`", "").replace("\"", "").trim();
return dir == Sort.Direction.DESC ? Sort.descending(clean) : Sort.ascending(clean);
} Type guard
boolean isSafeSortColumn(String name) {
return name != null && !name.contains("`") && !name.isBlank();
} Try / catch
try {
query.sort(Sort.by(userColumn));
} catch (PanacheQueryException e) {
throw new IllegalArgumentException("Unsupported sort column: " + userColumn, e);
} Prevention
- Always sort by entity attribute names, not SQL column names
- Sanitize user-supplied sort inputs by stripping quote characters
- Whitelist allowed sort fields instead of accepting arbitrary strings
- Avoid copy-pasting quoted identifiers from native SQL into Panache Sort
When it happens
Trigger: Calling Panache.find/list with Sort.by("`column`") where the inner name still contains backticks, or sorting by a name wrapped inconsistently such as "`name" or containing backticks mid-string, e.g. Sort.descending("`field`").
Common situations: Copy-pasting SQL column quoting into Panache sorts; double-quoting a column that was already quoted so the unquote step leaves inner backticks; building sort names dynamically from DDL metadata that includes backticks (MySQL-style quoting).
Related errors
- The named query '${namedQuery}' must be defined on your JPA
- Query string cannot be empty
- The annotation ProjectedFieldName must have a non-empty valu
- Entity '%s' was not found. Did you forget to annotate your P
- Sort cannot be used with named query, add an "order by" clau
AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05).
Data as JSON: /api/errors/e37bf1a147333e97.
Report an issue: GitHub.