Security: Make it clearer that you really need :quoted true to avoid injection via table/column names

[seancorfield]

If you have a dialect set as the default, :quoted false is the default and if you pass through user input as keywords (or symbols) for table/column/function names etc, those could be used to produce malicious SQL.

Also, make it clear that using arbitrary strings as aliases would also allow that.

[seancorfield]

Suggestion: auto-quote suspicious looking entities unless :quoted false (so make quoting a tristate value).

[seancorfield]

Updated PR #424 with a first pass on documentation as well as the auto-quoting of "unusual" entities.

[seancorfield]

Closing as documented sufficiently for release.