You cannot have whitespaces in database or table names.
The only characters you have to worry about are single quotes in text that you insert. These should be escaped by the \ character.
If magic_quotes_gpc is on in the php.ini file, then the quotes will be escaped automatically from form data when the form is submitted. If you want to escape them manually, then use $text = addslashes($text);
Hope that helps...
---John Holmes...