fix: escape special characters in SQL replacements

Author: Zxc4wonder

backend/framework/src/main/java/org/jumpserver/chen/framework/datasource/sql/SQL.java

@@ -37,7 +37,7 @@ public static SQL of(String sql, Map<String, Object> params) {
 
     public static SQL of(String sql, Object... params) {
         for (Object param : params) {
-            sql = sql.replaceFirst("\\?", param.toString());
+            sql = sql.replaceFirst("\\?", Matcher.quoteReplacement(param.toString()));
         }
         return new SQL(sql);
     }