Check for embedded quotes to avoid SQLi attacks about sql-spark-connector HOT 2 CLOSED

My initial thought is to use brackets for table name, but then concerned that below example will still inject sql db. So I tried prepared statement in PR #138, but it turns out table name cannot be parameter in prepared statement.
sql statement in src code:
SELECT * FROM ${table} WHERE 1=0; ($table is user input)
possible sql injection examples;
SELECT * FROM [table_a]; DROP table table_b --] WHERE 1=0;
Spark also uses sql statement (e.g. in JdbcUtils.scala) to drop / truncate / check existence of a table. tableExists() uses prepared statement to wrap the sql string but without parameters. In my opinion it does not avoid sql injection.

from sql-spark-connector.

I can inject sql table set dbtable = "test00(Col1 nvarchar(4)); DROP TABLE test1--", then my test1 will be dropped and test00 will be created. (inject the sql string in mssqlCreateTable()).

For now I do not think SQL Injection is a vulnerability in spark mssql connector.

1. The main point is that user who is creating / dropping / editing a sql table by JDBC must have the credentials already and could just open their own connection.
2. IMO spark has sql strings which might be vulnerable to sql injection. I think it is better to fix it in spark end.

from sql-spark-connector.