fix(spanner): escape embedded backticks in dbapi escape_name

[sakthivelmanii]

In google-cloud-spanner DB-API, escape_name() did not check for or double embedded backtick characters (`) when wrapping identifiers. This allowed identifiers containing backticks to break out of backtick-quoted identifier scopes (CWE-89 identifier injection).

This commit updates escape_name() to:

• Detect embedded backtick characters in identifier names.
• Escape internal backticks by doubling them (replace("`", "``")) when enclosing identifiers in backticks.
• Add unit test cases for embedded backticks in test_escape_name.

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

Fixes #<issue_number_goes_here> 🦕

[gemini-code-assist]

Code Review

This pull request updates the escape_name function in parse_utils.py to escape backticks by doubling them, and adds corresponding unit tests. The review feedback points out a critical security vulnerability (SQL injection) where identifiers containing other special characters (such as comments or semicolons) but no spaces, hyphens, or backticks could bypass escaping. A code suggestion is provided to resolve this by strictly validating identifiers and escaping any that are not valid regular ASCII identifiers.

[parthea]

Wait for #17880 to be merged first

Done. Please merge main into this branch

[olavloite]

GoogleSQL does not use 'doubled quotes' to escape quotes inside quotes. Instead, you should use a backslash for that:

-- This is invalid in GoogleSQL
select 1 as `fo``o`

-- This is the correct way to escape a quote in GoogleSQL
select 1 as `fo\`o`

[sakthivelmanii]

Done

[olavloite]

There are more corner cases that need to be thought through here:

1. Backslash (see also below): Backslash starts an escape sequence in GoogleSQL, unless itself is escaped. Should we escape backslashes as well to be consistent with how we handle existing backticks in identifiers? E.g. what should we do with a string like this: "test\"
2. Identifiers with multiple elements (dot operator): The identifier my_schema.my_table is now turned into this: `my_schema.my_table`.
3. Already quoted identifiers: `my_table` becomes ``my_table``

[sakthivelmanii]

Done