feat(sql): SQL Injection

build/drop.go

@@ -8,5 +8,11 @@ import (
 )
 
 func DropSQL(s *schema.Table) (string, error) {
+	if s == nil {
+		return "", fmt.Errorf("nil table provided")
+	}
+	if s.Name == "" || !utils.IsValidIdentifier(s.Name) {
+		return "", fmt.Errorf("invalid table name: %q", s.Name)
+	}
 	return fmt.Sprintf("DROP TABLE IF EXISTS %s", utils.SQLQuoteIdent(s.Name)), nil
 }