fix(spanner): escape embedded backticks in dbapi escape_name

In google-cloud-spanner DB-API, escape_name() did not check for or double embedded backtick characters (`) when wrapping identifiers. This allowed identifiers containing backticks to break out of backtick-quoted identifier scopes (CWE-89 identifier injection).

This commit updates escape_name() to:
- Detect embedded backtick characters in identifier names.
- Escape internal backticks by doubling them (replace("`", "``")) when enclosing identifiers in backticks.
- Add unit test cases for embedded backticks in test_escape_name.

Author: sakthivelmanii

packages/google-cloud-spanner/google/cloud/spanner_dbapi/parse_utils.py

@@ -384,15 +384,25 @@ def ensure_where_clause(sql):
 
 def escape_name(name):
     """
-    Apply backticks to the name that either contain '-' or
-    ' ', or is a Cloud Spanner's reserved keyword.
+    Apply backticks to the name if it is not a valid regular ASCII identifier,
+    or if it is a Cloud Spanner's reserved keyword.
 
     :type name: str
     :param name: Name to escape.
 
     :rtype: str
     :returns: Name escaped if it has to be escaped.
     """
-    if "-" in name or " " in name or name.upper() in SPANNER_RESERVED_KEYWORDS:
-        return "`" + name + "`"
+    if not name:
+        return name
+
+    is_valid_regular_identifier = (
+        (name[0].isalpha() or name[0] == "_")
+        and all(c.isalnum() or c == "_" for c in name)
+        and name.isascii()
+    )
+
+    if not is_valid_regular_identifier or name.upper() in SPANNER_RESERVED_KEYWORDS:
+        return "`" + name.replace("`", "``") + "`"
+
     return name

packages/google-cloud-spanner/tests/unit/spanner_dbapi/test_parse_utils.py

@@ -403,6 +403,13 @@ def test_escape_name(self):
             ("with space", "`with space`"),
             ("name", "name"),
             ("", ""),
+            ("col`; DROP TABLE t; -- x", "`col``; DROP TABLE t; -- x`"),
+            ("table`name", "`table``name`"),
+            ("`", "````"),
+            ("col/*comment*/name", "`col/*comment*/name`"),
+            ("123column", "`123column`"),
+            ("col;select", "`col;select`"),
+            ("col\nname", "`col\nname`"),
         )
         for name, want in cases:
             with self.subTest(name=name):