wheels: Quote-only escaping of inline literals on MySQL and MariaDB

Impact

A few paths still write values into SQL as quoted literals, escaping only single quotes (' -> ''):

• queries run with parameterize=false (opt-in), including its IN-list handling;
• literals in a developer-written where= string in positions the WHERE parser does not bind, such as BETWEEN ... AND ..., function arguments and LIKE ... ESCAPE '...'.

On MySQL and MariaDB with the default sql_mode (no NO_BACKSLASH_ESCAPES), a backslash is an escape character inside a string literal, so doubling quotes alone does not contain every value. If an application puts request data into one of these paths, the value can change the query. PostgreSQL (with the default standard_conforming_strings), SQL Server, SQLite, Oracle, H2 and CockroachDB treat a backslash literally and are not affected.

The bound paths (dynamic finders, the query builder, key lookups, and =/<>/</>/LIKE/IN comparisons in where= strings) are not affected; 4.1.2 also binds whereBetween().

Patches

Fixed in 4.2.0. On MySQL and MariaDB, a string value that Wheels writes into the SQL text instead of binding it (every value with parameterize=false, and literals that a where string leaves in place) is now written as a hex literal when it contains a backslash, so it reads the same whatever the sql_mode. The query-builder guide now lists which where values are bound.

Workarounds

Pass request data only through bound APIs (where(property, value), dynamic finders, whereIn, whereBetween in 4.1.2+), don't use parameterize=false with request data, or set NO_BACKSLASH_ESCAPES in the MySQL sql_mode.