the maximum field length for field names does not allow all custom field names to fit in, see this:

---------CUT---------
mysql> describe mantis_bug_history_table;
[...]
field_name | varchar(32) [...]
[...]
mysql> describe mantis_custom_field_table;
name | varchar(64)
---------CUT---------

This again leads to a real security issue where custom fields are still print out because the access check is unable to determine the access level of a custom field with a name exceeding 32 characters.

This is something that hit us along with bug 0007772.