Possible SQL Injection flaw

[bugflux]

Hello,

I'd like to understand in which scenarios we think using an object's "toString" is a valid conversion for a constant parameter, because it could lead to SQL Injection:

https://github.com/feedzai/pdb/blob/master/src/main/java/com/feedzai/commons/sql/abstraction/engine/AbstractTranslator.java#L245

[rpvilao-gymondo]

Seems like a valid point... the constant can be used everywhere possible like in where clauses, select columns etc. So it should be escaped if not already