>     -table-names and -column-names can be done with ordinary SQL (by
>     querying magic SQLite-only tables). Do they need their own procedures?
>
> Yes, if we ever hope to be portable off SQLite.  Providing them means
> that dynamic SQL can be constructed readily.  For example, you could
> have an application with a UI form where the user indicates the columns
> they want to use to populate a table of data.

OK, that sounds useful.

> The programmer would use
> sqlite-column-names to populate the form, and then specify a SQL
> statement like "SELECT ?cols FROM table".  By providing a list of the
> chosen column names (as symbols) as the "cols" argument, the statement
> will be correctly created with no risk of injection attacks from bogus
> column names.  And now you see why SQLite ?s are not enough.

I still think that:

1) this is overkill for a minimal SRFI

2) we shouldn't escape SQL in any Scheme library except as a last resort

3) any such escaping should be done in a SQLAlchemy style DSL that is
    fully aware of which part of SQL syntax it's generating at any
    given time.