diff --git a/backend/scripts/verify_grade10_ecosystem.php b/backend/scripts/verify_grade10_ecosystem.php
index 6d233ab..9e79852 100644
--- a/backend/scripts/verify_grade10_ecosystem.php
+++ b/backend/scripts/verify_grade10_ecosystem.php
@@ -93,7 +93,11 @@ class SaqelEcosystemTester
             $pdo = Database::getConnection();
             $this->assert($pdo instanceof \PDO, 'الاتصال بقاعدة البيانات PDO نشط ومستقر');
             foreach ($tables as $tbl) {
-                $check = Database::selectOne("SHOW TABLES LIKE ?", [$tbl]);
+            // MySQL does not accept PDO placeholders in SHOW TABLES LIKE.
+            // Table names come from this fixed internal allow-list, so quote
+            // the value explicitly rather than interpolating user input.
+            $safeTable = str_replace('`', '``', (string) $tbl);
+            $check = Database::selectOne("SHOW TABLES LIKE '" . addslashes($safeTable) . "'");
                 $this->assert(!empty($check), "جدول $tbl متوفر في قاعدة البيانات");
             }
         } catch (\Throwable $e) {