Escape dynamic SQL inputs in WizardService

[NB-Core]

Summary

• add addslashes() escaping before SQL interpolation in createTranslation()
• apply same escaping in deleteUntranslated()
• escape update query parameters in saveBatchTranslations()
• add inline notes explaining why manual escaping is used

Testing

• git status --short

---

https://chatgpt.com/codex/tasks/task_e_6873e4c0f9c0832989c0e07fce9a9f7a

[Copilot]

Pull Request Overview

This PR adds manual escaping for dynamic SQL inputs in WizardService due to the lack of parameterized query support.

• Escape input values with addslashes() in createTranslation(), deleteUntranslated(), and saveBatchTranslations()
• Add inline comments explaining why manual escaping is used

Comments suppressed due to low confidence (1)

systems/translationwizard/translationwizard/WizardService.php:12

• There are no tests covering edge cases for SQL inputs containing quotes or special characters. Adding test cases for createTranslation, deleteUntranslated, and saveBatchTranslations would help ensure the escaping logic works as intended.

    public static function createTranslation(string $language, string $namespace, string $intext, string $outtext, string $author, string $version) {