Potential fix for code scanning alert no. 75: SQL query built from user-controlled sources

[richard-churchman]

Potential fix for https://github.com/jube-home/jube/security/code-scanning/75

To fix the problem, we should use parameterized queries for the entire SQL statement, not just the values. This involves restructuring the code to avoid direct concatenation of user inputs into the SQL query. Instead, we should use placeholders for all parts of the query that are influenced by user input and then bind the actual values to these placeholders.

In the PrepareAsync method, we will modify the SQL query to use named parameters and bind the corresponding values from the parameters list. This will ensure that the SQL query is safe from injection attacks.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[richard-churchman]

This automated suggestion is way off.

I will use this branch however to remove the direct path for string concatenation. I believe in the commit that was intended to address this, there is already some checking that the values passed are valid based on model configuration. Here I will go a step further and look the values up, and concatenate them the value returned from various dictionaries or lists (they should after all be the same value). In the absence of the values available, will error it out.