title: does PHP mysql_real_escape_string() protect database name?
body: <p>I know that mysql_real_escape_string()<br>
       prepends backslashes to the following characters: \x00, \n, \r, \, ', " and \x1a</p>
  
  <p>I know how this protects a query from injection into something like a variable in a where clause.  But here's a scenario I am unsure of:</p>
  
  <p><code>$query = "SELECT * FROM $db WHERE 1";</code></p>
  
  <p>If $db is taken from a user input, then the user could insert something like:<br>
  $db = <code>'RealDatabase WHERE 1; DELETE FROM RealDatabase WHERE 1; SELECT FROM RealDatabase'</code>;  </p>
  
  <p>From my understanding, mysql_real_escape_string() would not affect this string,
  making the final query:
  <code>$query = "SELECT * FROM RealDatabase WHERE 1; DELETE FROM RealDatabase WHERE 1; SELECT FROM RealDatabase WHERE 1";</code></p>
  
  <p>which would delete the database.  Is there another level of protection I am unaware of?</p>