Refactor mssqlshell.py to improve code structure

[harshnair75567-cloud]

user input is interpolated directly into SQL query strings in several (do_) functions without escaping single quotes first. This means a user can break out of the intended SQL string by including a single quote in their input.

do_exec_as_login, do_exec_as_user, do_xp_dirtree, do_xp_cmdshell and do_sp_start_job are the affected functions

sql_query() already uses replace("'", "''") when wrapping queries for linked server execution. This PR applies the same escaping consistently to user input before it enters the query string in the affected functions.

each change is a single .replace("'", "''") call on the input string.

The sql_query() function does escape single quotes when a linked server is active via use_link, however this only applies to that specific code path. In the default usage with no linked server active the if self.at block is skipped entirely and the raw unescaped input goes directly to the SQL server. So the escaping needs to happen at the input level in each (do_) function, not rely on sql_query() to handle it

[harshnair75567-cloud]

the code was written by myself I did seek ai assistance while writing the description