check for sql injection paths; switch to using prepared sql statements (dplyr?)

[robkooper]

Pecan code base has lots of places where an sql injection can happen. We should switch as soon as possible to using prepared statements. We should look at the package dplyr for the database code (http://cran.rstudio.com/web/packages/dplyr/vignettes/databases.html). This package has two functions that might be hand escape and sql that will help create the queries.

dplyr has some other nice features in that you don't write sql statements but use functions to create select statements etc.

[mdietze]

@robkooper status?

[robkooper]

removed milestone since this is a bigger issue that will need to be resolved slowly over time.

[ashiklom]

@infotroph and I will probably try to tag-team this, as it's relevant for his Biocro work and my work on importing TRY.

[github-actions]

This issue is stale because it has been open 365 days with no activity.