Fix SQLi detection in deeply nested string building

Not all values were being checked for SQLi in cases with lots of string concatenation and interpolation (see test for example).

This also may change some warnings because it may warn about a different unescaped value in the SQL string.