fix: sanitize SQL comment/label to prevent comment injection

The comment() and label() methods passed user input directly into
SQL comments (/* ... */) without stripping */ sequences, allowing
comment breakout and potential SQL injection.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JSLEEKR

src/sqlink/builder.py

@@ -11,6 +11,11 @@
 from sqlink.types import JoinType, OrderDirection
 
 
+def _sanitize_comment(text: str) -> str:
+    """Strip comment-closing sequences to prevent SQL comment injection."""
+    return text.replace("*/", "* /").replace("/*", "/ *")
+
+
 @dataclass
 class _JoinClause:
     join_type: JoinType
@@ -95,12 +100,12 @@ def dialect(self, d: Dialect) -> Query:
 
     def comment(self, text: str) -> Query:
         """Add a SQL comment to the query (/* ... */)."""
-        self._comment = text
+        self._comment = _sanitize_comment(text)
         return self
 
     def label(self, name: str) -> Query:
         """Add a label/tag comment (/* app:label */) for query tracing."""
-        self._label = name
+        self._label = _sanitize_comment(name)
         return self
 
     # ── SELECT ──────────────────────────────────────────────

tests/test_comments.py

@@ -90,3 +90,17 @@ def test_label_preserved_in_clone(self):
     def test_no_comment_by_default(self):
         sql, _ = Query("users").select("*").build()
         assert "/*" not in sql
+
+    def test_comment_injection_sanitized(self):
+        """Prevent SQL injection via comment-closing sequences."""
+        sql, _ = Query("users").select("*").comment("evil */ DROP TABLE users; /*").build()
+        # The closing */ should only appear once (at the end of the comment)
+        assert sql.count("*/") == 1
+        # The opening /* should only appear once (at the start of the comment)
+        assert sql.count("/*") == 1
+
+    def test_label_injection_sanitized(self):
+        """Prevent SQL injection via label with comment-closing sequences."""
+        sql, _ = Query("users").select("*").label("evil */ DROP TABLE users; /*").build()
+        assert sql.count("*/") == 1
+        assert sql.count("/*") == 1