Repository: sequelize/sequelize
File: src/sql-string.js (JavaScript)

Code before:
      return dataTypes.ARRAY.prototype.stringify(val, { escape: partialEscape });
    }
    return arrayToList(val, timeZone, dialect, format);
  }

  if (!val.replace) {
    throw new Error(`Invalid value ${logger.inspect(val)}`);
  }

  if (['postgres', 'sqlite', 'mssql', 'snowflake', 'db2'].includes(dialect)) {
    // http://www.postgresql.org/docs/8.2/static/sql-syntax-lexical.html#SQL-SYNTAX-STRINGS
    // http://stackoverflow.com/q/603572/130598
    val = val.replace(/'/g, "''");

    if (dialect === 'postgres') {
      // null character is not allowed in Postgres
      val = val.replace(/\0/g, '\\0');
    }
  } else if (dialect === 'oracle' && typeof val === 'string') {
    if (val.startsWith('TO_TIMESTAMP_TZ') || val.startsWith('TO_DATE')) {
      const splitVal = val.split(/\(|\)/);
    
      if (splitVal.length !== 3 || splitVal[2] !== '') {
        throw new Error('Invalid SQL function call.');
      }
    
      const functionName = splitVal[0].trim();
      const insideParens = splitVal[1].trim();
    
      if (functionName !== 'TO_TIMESTAMP_TZ' && functionName !== 'TO_DATE') {
        throw new Error('Invalid SQL function call. Expected TO_TIMESTAMP_TZ or TO_DATE.');
      }
    
      const params = insideParens.split(',');
    
      if (params.length < 2) {
        throw new Error('Invalid format for TO_TIMESTAMP_TZ or TO_DATE');
      }
    
      const dateValue = params[0].trim().replace(/'/g, '');
      const formatValue = params[1].trim();
    
      if (functionName === 'TO_TIMESTAMP_TZ') {
        const expectedFormat = "'YYYY-MM-DD HH24:MI:SS.FFTZH:TZM'";
        if (formatValue !== expectedFormat) {
          throw new Error(`Invalid format string for TO_TIMESTAMP_TZ. Expected format: ${ expectedFormat}`);
        }
    
        const formattedDate = moment(dateValue).format('YYYY-MM-DD HH:mm:ss.SSS Z');
        if (formattedDate !== dateValue) {
          throw new Error("Invalid date value for TO_TIMESTAMP_TZ. Expected format: 'YYYY-MM-DD HH:mm:ss.SSS Z'");

Review comment (suggestion):
If I understand this right, we are checking here for the fact that we get something like `TO_DATE(col)` and have nothing coming after the closing paren? Please add a comment explaining this

Code after:
      return dataTypes.ARRAY.prototype.stringify(val, { escape: partialEscape });
    }
    return arrayToList(val, timeZone, dialect, format);
  }

  if (!val.replace) {
    throw new Error(`Invalid value ${logger.inspect(val)}`);
  }

  if (['postgres', 'sqlite', 'mssql', 'snowflake', 'db2'].includes(dialect)) {
    // http://www.postgresql.org/docs/8.2/static/sql-syntax-lexical.html#SQL-SYNTAX-STRINGS
    // http://stackoverflow.com/q/603572/130598
    val = val.replace(/'/g, "''");

    if (dialect === 'postgres') {
      // null character is not allowed in Postgres
      val = val.replace(/\0/g, '\\0');
    }
  } else if (dialect === 'oracle' && typeof val === 'string') {
    if (val.startsWith('TO_TIMESTAMP_TZ') || val.startsWith('TO_DATE')) {
      // Split the string using parentheses to isolate the function name, parameters, and potential extra parts
      const splitVal = val.split(/\(|\)/);
    
      // Validate that the split result has exactly three parts (function name, parameters, and an empty string)
      // and that there are no additional SQL commands after the function call (indicated by the last empty string).
      if (splitVal.length !== 3 || splitVal[2] !== '') {
        throw new Error('Invalid SQL function call.'); // Error if function call has unexpected format
      }
    
      // Extract the function name (either 'TO_TIMESTAMP_TZ' or 'TO_DATE') and the contents inside the parentheses
      const functionName = splitVal[0].trim(); // Function name should be 'TO_TIMESTAMP_TZ' or 'TO_DATE'
      const insideParens = splitVal[1].trim(); // This contains the parameters (date value and format string)
    
      if (functionName !== 'TO_TIMESTAMP_TZ' && functionName !== 'TO_DATE') {
        throw new Error('Invalid SQL function call. Expected TO_TIMESTAMP_TZ or TO_DATE.');
      }
    
      // Split the parameters inside the parentheses by commas (should contain exactly two: date and format)
      const params = insideParens.split(',');
    
      // Validate that the parameters contain exactly two parts (date value and format string)
      if (params.length !== 2) {
        throw new Error('Unexpected input received.\nSequelize supports TO_TIMESTAMP_TZ or TO_DATE exclusively with a combination of value and format.');
      }
    
      // Extract the date value (first parameter) and remove single quotes around it
      const dateValue = params[0].trim().replace(/'/g, '');
      const formatValue = params[1].trim();
    
      if (functionName === 'TO_TIMESTAMP_TZ') {
        const expectedFormat = "'YYYY-MM-DD HH24:MI:SS.FFTZH:TZM'";