There are some cases where we're integrating externally-provided string directly into SQL without quoting/sanitation, e.g. here. We should do a proper pass before releasing to ensure we don't do this anywhere.

/cc @westey-m @dmytrostruk @adamsitnik