Description:
------------
I think mysql_escape_string() and 
mysql_real_escape_string() should escape backquotes to 
avoid potential security problems in case an application 
uses an input field as the name for a table or for a 
field. So... 

Reproduce code:
---------------
<?
	$name = $_POST["name"];
	$ename = mysql_real_escape_string($name);
	print("'$name' => '$ename'");
	@mysql_query("INSERT INTO `$ename` SET `blah`='blah'");
?>

Expected result:
----------------
'` SET `protectedfield`=1' => '\` SET \`protectedfield
\`=1' 

Actual result:
--------------
'` SET `protectedfield`=1' => '` SET `protectedfield`=1' 
 
This way the query modifies a field which was not supposed 
to be modified.