Cleanup and document hacky sql interaction

pkg/sqle/name.go

@@ -5,8 +5,13 @@ import (
 	"unicode"
 )
 
-// IsSafeDatabaseName checks if a string is safe to be used as a database name
-func IsSafeDatabaseName(value string) bool {
+// IsSafeDatabaseSingleQuote checks if value can safely be put inside 's inside a database query
+func IsSafeDatabaseSingleQuote(value string) bool {
+	return !strings.ContainsAny(value, "'`") // TODO: This should be safer, but it's relatively controlled
+}
+
+// IsSafeDatabaseLiteral checks if a value is safe to be used as a database query literal
+func IsSafeDatabaseLiteral(value string) bool {
 	// the empty name is not allowed!
 	if len(value) == 0 {
 		return false

pkg/sqle/sqle.go

@@ -4,6 +4,8 @@ import (
 	"github.com/feiin/sqlstring"
 )
 
+// TODO: This is really unsafe and shouldn't be used at all.
+
 // Format formats the provided query with the given parameters.
 func Format(query string, params ...interface{}) string {
 	return sqlstring.Format(query, params...)