Not sure why there are comments on this about SQLite's "correctness" or "testing": these are "works as intended" oversights where you run a query and SQLite does as you asked, except if you give an attacker too much control over the query it gives an unpredicted amount of control over what it lets you do. It's similar to command injection: bash could be 100% fuzzed and covered, but if you pass a string into it unescaped it's still going to let an attacker run code…