Fix SQL injection, query value handling, and other security issues

- Quote all identifiers and validate operators, order strategies, join
  types, raw comparisons, and limit/offset/page in the query generator
- Treat 0 as a real query value; stop null from leaving unbound
  placeholders
- Return the WHERE clause and its values separately from sqlGenerator so
  delete/update no longer regex-parse generated SQL
- update(): target matched row ids, re-fetch reliably, and return
  success: false when no rows match
- Fix duplicated aliases, [object Object] select fields, AVERAGE -> AVG,
  escape GROUP_CONCAT separators
- Fix OFFSET without LIMIT and OFFSET on count queries
- Store boolean false as 0 on insert; call function values once
- Verify TLS certificates by default (new ssl_reject_unauthorized option)
- Confirm before importing an executable schema from an archive (--yes)
- Skip symlinks when reading extracted zip archives
- Only trim files matching the backup/export naming pattern
- Tighten default HTML sanitizer (no style/id attributes, no button)
- Stop typedef generation from mutating parent table schemas
- Pass config through DbSQL; handle BigInt values in results

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/lib/mariadb/db-delete.ts

@@ -6,6 +6,7 @@ import type {
     ServerQueryParam,
 } from "../../types";
 import sqlGenerator from "../../utils/sql-generator";
+import { quoteIdentifier } from "../../utils/sql-identifier";
 
 type Params<
     Schema extends { [k: string]: any } = { [k: string]: any },
@@ -17,10 +18,6 @@ type Params<
     config?: BunMariaDBConfig;
 };
 
-function quoteIdentifier(identifier: string): string {
-    return `\`${identifier.replace(/`/g, "``")}\``;
-}
-
 export default async function DbDelete<
     Schema extends { [k: string]: any } = { [k: string]: any },
     Table extends string = string,
@@ -49,11 +46,11 @@ export default async function DbDelete<
         }
 
         sqlObj = sqlGenerator({
-            tableName: quoteIdentifier(table),
+            tableName: table,
             genObject: finalQuery,
         });
 
-        const whereClause = sqlObj.string.match(/WHERE .*/)?.[0];
+        const whereClause = sqlObj.where;
 
         if (!whereClause) {
             return {
@@ -68,6 +65,7 @@ export default async function DbDelete<
         let sql = `DELETE FROM ${quoteIdentifier(table)} ${whereClause}`;
         sql += ` RETURNING *`;
         sqlObj.string = sql;
+        sqlObj.values = sqlObj.whereValues;
 
         const res = await dbHandler({
             query: sql,