fix: Comprehensive SQL injection protection in funcspec handlers

[Copilot]

The original security fix added ValidSQL sanitization but missed multiple SQL injection vectors where user-controlled input was directly concatenated into queries.

Vulnerabilities Fixed

Direct string replacement injection:

• Path parameters in mergePathParams - no sanitization before strings.ReplaceAll
• Query parameters with p- prefix in mergeQueryParams
• Header parameters in mergeHeaderParams

IN clause injection:

// Before: unsanitized array concatenation
sqlquery = fmt.Sprintf("%s IN (%s)", ValidSQL(colname, "colname"), strings.Join(parmv, ","))

// After: sanitize each value, conditionally quote strings vs numerics
sanitizedValues := make([]string, len(parmv))
for i, v := range parmv {
    if IsNumeric(v) {
        sanitizedValues[i] = ValidSQL(v, "colvalue")
    } else {
        sanitizedValues[i] = fmt.Sprintf("'%s'", ValidSQL(v, "colvalue"))
    }
}

ValidSQL Enhancements

• Added backslash escaping in colvalue mode (was only escaping single quotes)
• LIKE pattern handling: escape quotes/backslashes while preserving % and _ wildcards
• Optimized select mode: single pre-compiled case-insensitive regex instead of per-pattern compilation
• Extended dangerous keywords: EXEC, EXECUTE, UNION, DECLARE, ALTER, CREATE

Known Limitation

Placeholder replacements ([param]) require proper quoting in SQL templates. Example:

-- Vulnerable: WHERE name = [username]
-- Safe: WHERE name = '[username]'

Fixing this would break existing templates - should be addressed separately.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.