title: Vulnerability to SQL injection even when SQLite3::escapeString() is used and no user input is asked?
body: <p>I am referring to <a href="https://stackoverflow.com/a/58200724/8586810">this answer of mine to another question</a>, which another user criticized because vulnerable to SQL injection, even if no user input is requested and escape procedure is called.
  The following code is used to create a .sql dump of an SQLite database, using only PHP code with no call to sqlite3 tool (which was the original request of the author of the question).</p>
  
  <pre><code>&lt;?php
  
  $db = new SQLite3(dirname(__FILE__)."/your/db.sqlite");
  $db-&gt;busyTimeout(5000);
  
  $sql="";
  
  $tables=$db-&gt;query("SELECT name FROM sqlite_master WHERE type ='table' AND name NOT LIKE 'sqlite_%';");
  
  while ($table=$tables-&gt;fetchArray(SQLITE3_NUM)) {
      $sql.=$db-&gt;querySingle("SELECT sql FROM sqlite_master WHERE name = '{$table[0]}'").";\n\n";
      $rows=$db-&gt;query("SELECT * FROM {$table[0]}");
      $sql.="INSERT INTO {$table[0]} (";
      $columns=$db-&gt;query("PRAGMA table_info({$table[0]})");
      $fieldnames=array();
      while ($column=$columns-&gt;fetchArray(SQLITE3_ASSOC)) {
          $fieldnames[]=$column["name"];
      }
      $sql.=implode(",",$fieldnames).") VALUES";
      while ($row=$rows-&gt;fetchArray(SQLITE3_ASSOC)) {
          foreach ($row as $k=&gt;$v) {
              $row[$k]="'".SQLite3::escapeString($v)."'";
          }
          $sql.="\n(".implode(",",$row)."),";
      }
      $sql=rtrim($sql,",").";\n\n";
  }
  file_put_contents("sqlitedump.sql",$sql);
  </code></pre>
  
  <p>In the comments to this answer, user @Dharman insisted this code is vulnerable, and after asking to provide a full example of a case of how it could lead to problems, he told me to just open a question regarding the matter.</p>
  
  <p>I personally feel there is no way this code could "explode" because of the contents already present inside the database to be dumped, but I'm no authority.
  So I ask you instead.</p>