Bind SQL keys as parameters; allowlist raw-SQL table names (fixes injection) - #7

Merged

thorwhalen merged 2 commits into

fix/bind-sql-keys-and-identifiers

Sep 22, 2026

Commits on Sep 22, 2026

fix(base,sql_base): bind keys as parameters, allowlist raw-SQL table names

thorwhalen
and
claude
committed
e8c7bf1
fix(base,sql_base): address refute review of the injection fix

thorwhalen
and
claude
committed
02cbfe2