Currently, we have various places [1] where we use fmt.Sprintf() with %s to format SQL statements. This is prone to SQL injections bugs. Instead we should be using lexbase.EncodeSQLString to properly escape the statements.

edit (knz): note that tree.Name has a String() method that already does the right thing, so it's OK to do %s with a tree.Name. With string, not so much.

[1]: for instance (not comprehensive):

• cockroach/pkg/sql/delegate/show_schedules.go

  Line 55 in 8d4af45

  "executor_type = '%s'", tree.ScheduledBackupExecutor.InternalName()))

• cockroach/pkg/sql/delegate/show_syntax.go

  Line 40 in f18f7b8

  &query, "SELECT @1 AS %s, @2 AS %s FROM (VALUES ",

• cockroach/pkg/sql/sqlstats/persistedsqlstats/stmt_reader.go

  Line 135 in 08a8eec

  query = fmt.Sprintf("%s ORDER BY %s", query, strings.Join(orderByColumns, ","))

Jira issue: CRDB-9593

Epic CRDB-60948