feat: use place holders for update and delete (#323)

Co-authored-by: Johannes Vogel <31311694+johannes-vogel@users.noreply.github.com>

db-service/lib/cqn2sql.js

@@ -70,7 +70,7 @@ class CQN2SQLRenderer {
     /** @type {unknown[]} */
     this.values = [] // prepare values, filled in by subroutines
     this[cmd]((this.cqn = q)) // actual sql rendering happens here
-    if (vars?.length && !this.values.length) this.values = vars
+    if (vars?.length && !this.values?.length) this.values = vars
     const sanitize_values = process.env.NODE_ENV === 'production' && cds.env.log.sanitize_values !== false
     DEBUG?.(
       this.sql,

hana/lib/HANAService.js

@@ -261,6 +261,8 @@ class HANAService extends SQLService {
 
       // When one of these is defined wrap the query in a sub query
       if (expand || limit || one || orderBy) {
+        if (expand === 'root') this.values = undefined
+
         q.SELECT.expand = false
 
         if (expand === 'root') {
@@ -527,6 +529,7 @@ class HANAService extends SQLService {
     }
 
     INSERT_entries(q) {
+      this.values = undefined
       const { INSERT } = q
       // REVISIT: should @cds.persistence.name be considered ?
       const entity = q.target?.['@cds.persistence.name'] || this.name(q.target?.name || INSERT.into.ref[0])
@@ -682,27 +685,6 @@ class HANAService extends SQLService {
       return this.xpr({ xpr }, ' = TRUE')
     }
 
-    // REVISIT: why is that a complete copy from the base class?
-    val({ val }) {
-      switch (typeof val) {
-        case 'function': throw new Error('Function values not supported.')
-        case 'undefined': return 'NULL'
-        case 'boolean': return `${val}`
-        case 'number': return `${val}` // REVISIT for HANA
-        case 'object':
-          if (val === null) return 'NULL'
-          if (val instanceof Date) return `'${val.toISOString()}'`
-          if (val instanceof Readable){
-            this.values.push(val)
-            return '?'
-          }
-          else if (Buffer.isBuffer(val)) val = val.toString('base64')
-          else if (is_regexp(val)) val = val.source
-          else val = JSON.stringify(val)
-        case 'string': // eslint-disable-line no-fallthrough
-      }
-      return this.string(val)
-    }
 
     xpr({ xpr, _internal }, caseSuffix = '') {
       // Maps the compare operators to what to return when both sides are null