Remember the old trick of creating a table with spaces as its name? It’s been around for decades, and yes, it still works in Oracle 23c and even the latest 2026 release. But before you think about using it to hide your secret data, let’s talk about why this is a terrible idea from a security and database administration standpoint.
The Original Trick
You can create a table with spaces as its name using a quoted identifier:
CREATE TABLE " " (empno NUMBER(3));
That statement creates a table with three spaces as its name. Inserting data works similarly:
INSERT INTO " " VALUES (3);
And querying requires matching the exact spaces:
SELECT * FROM " ";
This table won’t appear in USER_TABLES with a normal SELECT unless you specifically filter for spaces, but it does show up in DBA_TABLES or ALL_TABLES with a WHERE table_name LIKE '% %'.
Detection and Modern Implications
While it might feel like a clever obfuscation, this technique is trivial to detect. A simple SELECT table_name FROM all_tables WHERE table_name != TRIM(table_name) catches all such tables. Modern Oracle environments (2026) have automated auditing tools that flag any object names deviating from standard naming conventions. Additionally, these tables cause headaches with exports, imports, and replication – most tools choke on leading/trailing spaces in names.
More critically, this isn’t real security. It’s obscurity at best. Anyone with SELECT ANY TABLE or DBA privileges can list and query these tables. For true confidentiality, Oracle provides robust features like Virtual Private Database (VPD), Transparent Data Encryption (TDE), and fine-grained access control. Relying on hidden table names is akin to hiding a safe behind a curtain – it only deters the laziest observer.
Modern 2026 Trends & Best Practices
In the current Oracle ecosystem, the focus is on defense-in-depth. Instead of quirky naming tricks, implement:
- Data Redaction: Mask sensitive columns dynamically based on user roles.
- Audit Vault: Monitor access to all objects, including those with unusual names.
- Unified Auditing: Track every
CREATEandSELECTstatement on any table. - Naming Conventions: Enforce standardized, meaningful names via database triggers or enterprise tools.
If you’re still tempted to use spaces as a table name for obfuscation, stop. It’s not security through obscurity; it’s a maintenance nightmare waiting to happen. Use Oracle’s native security features instead.
Official Documentation & Reference Links: