Security fix for SQL injection

Fixed a SQL injection vulnerability in `sql.identifier()` and `sql.as()` functions where values weren't being properly escaped. This release addresses CWE-89 by ensuring all values passed to these functions are now safely escaped.