Fix SQL injection, query value handling, and other security issues

- Quote all identifiers and validate operators, order strategies, join
  types, raw comparisons, and limit/offset/page in the query generator
- Treat 0 as a real query value; stop null from leaving unbound
  placeholders
- Return the WHERE clause and its values separately from sqlGenerator so
  delete/update no longer regex-parse generated SQL
- update(): target matched row ids, re-fetch reliably, and return
  success: false when no rows match
- Fix duplicated aliases, [object Object] select fields, AVERAGE -> AVG,
  escape GROUP_CONCAT separators
- Fix OFFSET without LIMIT and OFFSET on count queries
- Store boolean false as 0 on insert; call function values once
- Verify TLS certificates by default (new ssl_reject_unauthorized option)
- Confirm before importing an executable schema from an archive (--yes)
- Skip symlinks when reading extracted zip archives
- Only trim files matching the backup/export naming pattern
- Tighten default HTML sanitizer (no style/id attributes, no button)
- Stop typedef generation from mutating parent table schemas
- Pass config through DbSQL; handle BigInt values in results

Co-Authored-By: Claude Opus 5.5 <[email protected]>

README.md

@@ -212,6 +212,7 @@ The config file must be named `bun-mariadb.config.ts` and placed at the project
 | `charset`            | `string` | No       | Database charset (default: `utf8mb4`)                                         |
 | `connection_timeout` | `number` | No       | Connection timeout in ms (default: `10000`)                                   |
 | `ssl_ca`             | `string` | No       | Path to SSL CA certificate (relative to project root)                         |
+| `ssl_reject_unauthorized` | `boolean` | No  | Verify the server TLS certificate (default: `true`). Set `false` only for trusted self-signed setups |
 | `html_sanitize`      | `object` | No       | Extra HTML sanitizer allowlists (see [HTML Sanitization](#html-sanitization)) |
 
 Schema file path is always: `{db_dir}/schema.ts`.
@@ -469,11 +470,12 @@ bunx bun-mariadb import [file] [options]
 | `[file]`        | Path to a `.sql` dump or export archive (`.tar.gz` / `.tar` / `.zip`) |
 | `--sql-only`    | Archive only: restore SQL, do not overwrite `schema.ts`               |
 | `--schema-only` | Archive only: write `schema.ts`, do not restore SQL                   |
+| `-y, --yes`     | Archive only: skip the confirmation before writing a `.ts`/`.js` schema |
 
 Behavior:
 
 - **`.sql` file** — restores SQL into the configured database (same as restore, but non-interactive)
-- **Export archive** — restores `dump.sql` and writes `schema.ts` into `db_dir`
+- **Export archive** — restores `dump.sql` and writes `schema.ts` into `db_dir`. A `.ts`/`.js` schema is executed when loaded, so you are asked to confirm first (non-interactive runs require `--yes`). Only import archives from sources you trust.
 - **No file argument** — interactive picker of archives in `{db_dir}/.exports`
 
 **Examples:**
@@ -837,6 +839,8 @@ const config: BunMariaDBConfig = {
 
 Config values are **appended** to the built-in defaults (safe rich-text tags/attributes).
 
+`style` and `id` attributes (and the `button` tag) are **not** allowed by default, since they enable CSS overlays and DOM clobbering. Add them through `allowed_attributes` / `allowed_tags` if you need them.
+
 ---
 
 ## TypeScript Type Generation