Fix sql injection and add test cases

/to @ritch 
/cc @bajtos 

The PR fixes some paths that can be exploited with SQL injection as illustrated by https://github.com/strongloop-community/loopback-mysql-example/issues/3. 

A list of tests are added to improve the coverage too.