Added query parameterization

[xiangyan99]

What does this PR do?

[Provide a clear, concise description of the changes]

Added query parameterization

[Add additional context, screenshots, or information that helps reviewers]

GitHub issue number?

[Link to the GitHub issue this PR addresses]

Pre-merge Checklist

• Required for All PRs
  • Read contribution guidelines
  • PR title clearly describes the change
  • Commit history is clean with descriptive messages (cleanup guide)
  • Added comprehensive tests for new/modified functionality
  • Created a changelog entry if the change falls among the following: new feature, bug fix, UI/UX update, breaking change, or updated dependencies. Follow the changelog entry guide
• For MCP tool changes:
  • One tool per PR: This PR adds or modifies only one MCP tool for faster review cycles
  • Updated servers/Azure.Mcp.Server/README.md and/or servers/Fabric.Mcp.Server/README.md documentation
  • Validate README.md changes running the script ./eng/scripts/Process-PackageReadMe.ps1. See Package README
  • For new or modified tool descriptions, ran ToolDescriptionEvaluator and obtained a score of 0.4 or more and a top 3 ranking for all related test prompts
  • For tools with new names, including new tools or renamed tools, update consolidated-tools.json
  • For renamed tools, follow the Tool Rename Checklist and tag the PR with the breaking-change label
  • For new tools associated with Azure services or publicly available tools/APIs/products, add URL to documentation in the PR description
• Extra steps for Azure MCP Server tool changes:
  • Updated command list in servers/Azure.Mcp.Server/docs/azmcp-commands.md
  • Ran ./eng/scripts/Update-AzCommandsMetadata.ps1 to update tool metadata in azmcp-commands.md (required for CI)
  • Updated test prompts in servers/Azure.Mcp.Server/docs/e2eTestPrompts.md
  • 👉 For Community (non-Microsoft team member) PRs:
    • Security review: Reviewed code for security vulnerabilities, malicious code, or suspicious activities before running tests (crypto mining, spam, data exfiltration, etc.)
    • Manual tests run: added comment /azp run mcp - pullrequest - live to run Live Test Pipeline

[Copilot]

Pull request overview

Adds shared query-safety helpers in Microsoft.Mcp.Core and wires them into multiple tools to reduce injection risk by parameterizing SQL string literals and escaping/sanitizing KQL inputs.

Changes:

• Introduces SqlQueryParameterizer (SQL string-literal parameterization) and KqlSanitizer (KQL escaping/sanitization) in Microsoft.Mcp.Core.Helpers.
• Updates MySQL/Postgres/Cosmos query execution paths to bind extracted parameters instead of embedding string literals directly.
• Updates Kusto/Monitor/Deploy KQL construction/execution to validate and/or escape identifiers and string values; adds unit tests and a changelog entry.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
tools/Azure.Mcp.Tools.Postgres/tests/Azure.Mcp.Tools.Postgres.UnitTests/Services/PostgresServiceParameterizationTests.cs	Adds unit tests covering SQL string-literal parameterization behavior (Postgres dialect).
tools/Azure.Mcp.Tools.Postgres/src/Services/PostgresService.cs	Applies parameterization before creating/executing NpgsqlCommand.
tools/Azure.Mcp.Tools.MySql/tests/Azure.Mcp.Tools.MySql.UnitTests/Services/MySqlServiceParameterizationTests.cs	Adds unit tests covering SQL string-literal parameterization behavior (MySQL dialect).
tools/Azure.Mcp.Tools.MySql/src/Services/MySqlService.cs	Applies parameterization before executing MySqlCommand.
tools/Azure.Mcp.Tools.Monitor/tests/Azure.Mcp.Tools.Monitor.UnitTests/MonitorServiceKqlEscapingTests.cs	Adds unit tests for KQL identifier escaping helper usage.
tools/Azure.Mcp.Tools.Monitor/src/Services/MonitorService.cs	Escapes the table placeholder in predefined KQL queries.
tools/Azure.Mcp.Tools.Kusto/tests/Azure.Mcp.Tools.Kusto.UnitTests/SanitizeKqlStringLiteralsTests.cs	Adds unit tests for KQL string literal sanitization.
tools/Azure.Mcp.Tools.Kusto/tests/Azure.Mcp.Tools.Kusto.UnitTests/KqlQueryValidatorTests.cs	Adds unit tests for KQL query safety validation rules.
tools/Azure.Mcp.Tools.Kusto/src/Validation/KqlQueryValidator.cs	Introduces KQL query validation to block comments, management commands, stacked statements, and common tautologies.
tools/Azure.Mcp.Tools.Kusto/src/Services/KustoService.cs	Adds KQL validation + string-literal sanitization before query execution; refactors identifier escaping to shared helper.
tools/Azure.Mcp.Tools.Deploy/tests/Azure.Mcp.Tools.Deploy.UnitTests/Services/AzdAppLogRetrieverKqlEscapingTests.cs	Adds unit tests for KQL string value escaping used in Deploy log queries.
tools/Azure.Mcp.Tools.Deploy/src/Services/Util/AzdAppLogRetriever.cs	Escapes user-provided values interpolated into KQL log queries.
tools/Azure.Mcp.Tools.Deploy/src/AssemblyInfo.cs	Updates InternalsVisibleTo list to include Deploy unit tests.
tools/Azure.Mcp.Tools.Cosmos/tests/Azure.Mcp.Tools.Cosmos.UnitTests/CosmosServiceParameterizationTests.cs	Adds unit tests covering SQL string-literal parameterization behavior for Cosmos SQL queries.
tools/Azure.Mcp.Tools.Cosmos/src/Services/CosmosService.cs	Applies parameterization and binds parameters via QueryDefinition.WithParameter.
servers/Azure.Mcp.Server/changelog-entries/1775582739966.yaml	Adds a changelog entry describing the new parameterization/sanitization behavior.
core/Microsoft.Mcp.Core/src/Helpers/SqlQueryParameterizer.cs	Adds a shared SQL single-quoted literal parser/parameterizer with dialect support.
core/Microsoft.Mcp.Core/src/Helpers/KqlSanitizer.cs	Adds shared helpers for escaping KQL identifiers/values and sanitizing string literals.

[vukelich]

Couple early comments. Still more to read.