Merge fix: escape identifier delimiters in Flavor.Quote

Merges the identifier quoting SQL injection fix after passing CI.

Author: huandu

flavor.go

@@ -6,6 +6,7 @@ package sqlbuilder
 import (
 	"errors"
 	"fmt"
+	"strings"
 )
 
 // Supported flavors.
@@ -168,11 +169,11 @@ func (f Flavor) NewCTEQueryBuilder() *CTEQueryBuilder {
 func (f Flavor) Quote(name string) string {
 	switch f {
 	case MySQL, ClickHouse, Doris:
-		return fmt.Sprintf("`%s`", name)
+		return fmt.Sprintf("`%s`", strings.ReplaceAll(name, "`", "``"))
 	case PostgreSQL, SQLServer, SQLite, Presto, Oracle, Informix:
-		return fmt.Sprintf(`"%s"`, name)
+		return fmt.Sprintf(`"%s"`, strings.ReplaceAll(name, `"`, `""`))
 	case CQL:
-		return fmt.Sprintf("'%s'", name)
+		return fmt.Sprintf("'%s'", strings.ReplaceAll(name, "'", "''"))
 	}
 
 	return name

flavor_test.go

@@ -31,6 +31,33 @@ func TestFlavor(t *testing.T) {
 	}
 }
 
+func TestFlavorQuoteEscapesDelimiters(t *testing.T) {
+	cases := []struct {
+		flavor Flavor
+		input  string
+		want   string
+	}{
+		{MySQL, "name` DESC", "`name`` DESC`"},
+		{ClickHouse, "name` DESC", "`name`` DESC`"},
+		{Doris, "name` DESC", "`name`` DESC`"},
+		{PostgreSQL, `name" DESC`, `"name"" DESC"`},
+		{SQLServer, `name" DESC`, `"name"" DESC"`},
+		{SQLite, `name" DESC`, `"name"" DESC"`},
+		{Presto, `name" DESC`, `"name"" DESC"`},
+		{Oracle, `name" DESC`, `"name"" DESC"`},
+		{Informix, `name" DESC`, `"name"" DESC"`},
+		{CQL, "name' DESC", "'name'' DESC'"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.flavor.String(), func(t *testing.T) {
+			if got := tc.flavor.Quote(tc.input); got != tc.want {
+				t.Fatalf("Quote(%q) = %q, want %q", tc.input, got, tc.want)
+			}
+		})
+	}
+}
+
 func ExampleFlavor() {
 	// Create a flavored builder.
 	sb := PostgreSQL.NewSelectBuilder()