dynamic SQL strings should be audited for possible injections

  let name = "pen";
  let rows = sqlx::query(&format!("select id from item where name = '{name}'"))
    .fetch_all(&pool)
    .await?;

error[E0277]: dynamic SQL strings should be audited for possible injections
   --> src/bin/sqlsafe_fail.rs:7:26
    |
  7 |   let rows = sqlx::query(&format!("select id from item where name = '{name}'"))
    |              ----------- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ dynamic SQL string
    |              |
    |              required by a bound introduced by this call
    |
    = help: the trait `SqlSafeStr` is not implemented for `&std::string::String`
    = note: prefer literal SQL strings with bind parameters or `QueryBuilder` to add dynamic data to a query.
            
            To bypass this error, manually audit for potential injection vulnerabilities and wrap with `AssertSqlSafe()`.
            For details, see the docs for `SqlSafeStr`.
            
    = note: this trait is only implemented for `&'static str`, not all `&str` like the compiler error may suggest
help: the trait `SqlSafeStr` is implemented for `&str`
   --> ~/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sqlx-core-0.9.0/src/sql_str.rs:52:1
    |
 52 | impl SqlSafeStr for &'static str {
    | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
note: required by a bound in `sqlx::query`
   --> ~/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sqlx-core-0.9.0/src/query.rs:653:32
    |
653 | pub fn query<'a, DB>(sql: impl SqlSafeStr) -> Query<'a, DB, <DB as Database>::Arguments>
    |                                ^^^^^^^^^^ required by this bound in `query`

For more information about this error, try `rustc --explain E0277`.

  let sql = format!("update item set note = null where name = '{name}'");
  pool.execute(sql.as_str()).await?;

error[E0597]: `sql` does not live long enough
  --> src/bin/sqlsafe_fail2.rs:8:16
   |
 7 |   let sql = format!("update item set note = null where name = '{name}'");
   |       --- binding `sql` declared here
 8 |   pool.execute(sql.as_str()).await?;
   |   -------------^^^----------
   |   |            |
   |   |            borrowed value does not live long enough
   |   argument requires that `sql` is borrowed for `'static`
 9 |   Ok(())
10 | }
   | - `sql` dropped here while still borrowed
   |
note: requirement that the value outlives `'static` introduced here
  --> ~/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sqlx-core-0.9.0/src/executor.rs:63:17
   |
63 |         E: 'q + Execute<'q, Self::Database>,
   |                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

For more information about this error, try `rustc --explain E0597`.

  let name = "x' or '1'='1";

  // what the format! version would have done once wrapped in AssertSqlSafe
  let ids: Vec<i64> = sqlx::query_scalar(AssertSqlSafe(format!("select id from item where name = '{name}'")))
    .fetch_all(&pool)
    .await?;
  println!("format!+Assert -> {ids:?}");

  // 1. values: bind
  let ids: Vec<i64> = sqlx::query_scalar("select id from item where name = $1")
    .bind(name)
    .fetch_all(&pool)
    .await?;
  println!("bind           -> {ids:?}");

  // 2. identifiers: pick from a fixed list, then assert
  let sort = "price; drop table item";
  let column = match sort {
    "name" | "price" | "created_at" => sort,
    _ => "id",
  };
  let ids: Vec<i64> = sqlx::query_scalar(AssertSqlSafe(format!("select id from item order by {column} desc")))
    .fetch_all(&pool)
    .await?;
  println!("whitelist      -> order by {column}: {ids:?}");

  // 3. optional filters: QueryBuilder
  let min_price: Option<f64> = Some(5.0);
  let has_note: Option<bool> = None;
  let mut qb: QueryBuilder<Postgres> = QueryBuilder::new("select id from item where true");
  if let Some(p) = min_price {
    qb.push(" and price >= ").push_bind(p).push("::numeric");
  }
  if let Some(n) = has_note {
    qb.push(" and (note is not null) = ").push_bind(n);
  }
  println!("QueryBuilder   -> {}", qb.sql().as_str());
  let ids = qb.build_query_scalar::<i64>().fetch_all(&pool).await?;
  println!("               -> {ids:?}");

format!+Assert -> [1, 2, 3]
bind           -> []
whitelist      -> order by id: [3, 2, 1]
QueryBuilder   -> select id from item where true and price >= $1::numeric
               -> [1]