Prevent SQL Injection

[chaseWillden]

Currently we are doing the format! function to create the SQL statements, this technically would allow for easy SQL injection attacks. This is to provide sanitization of the SQL before execution

[mjovanc]

You mean doing something like this below?

fn sanitize_input(input: &str) -> String {
    input
        .replace('\'', "''") // Escape single quotes
        .replace('\\', "\\\\") // Escape backslashes
        .replace('%', "\\%") // Escape LIKE wildcards
        .replace('_', "\\_") // Escape LIKE wildcards
}