Not clear why it's called sql. It just escapes some special characters.

It's implicitly constructible from std::string and also implicitly convertible to std::string, which is not a good idea.