`sql` does not properly escape parameters when building SQL queries, resulting in potential SQLi

It allows to insert potentially user-controlled content into the queries without proper escaping, in cases where that is not verified additionally in the applications that are using `sql` library.

var sql = require('sql');
var user = sql.define({
  name: 'users',
  columns: ['id', 'name', 'email', 'lastLogin']
});
console.log(user.select(user.star()).from(user).limit('1; drop table users').toQuery().text);
console.log(user.select(user.star()).from(user).offset('1; drop table …