fix(security): shell-quote all caller-controlled values in database builders