MySQL uses `backticks` for quoting identifiers, ANSI SQL and PostgreSQL use "double-quotes", SQL Server and MS Access use [square brackets].

SQLite supports all three: https://www.sqlite.org/lang_keywords.html

Other rdbms have identifier quoting, yes. But the problem isn't that identifier quoting exists, it's that the library interprets an object as a key = value statement (compounded treating the key as an identifier), which it shouldn't.

    ... AND password = password = 1

is just wrong, quoted or not.

Also, the fact that the library doesn't validate the type of the input data ({password: 1} when the password should be a string...).

This is just a cascading chain of failures.

Yes. Almost all DBMSs has a way to delimit table/column names (for instance when a name contains spaces or special characters.

However, proper DBMSs expose parameters as 1st class concepts through the API. That has several advantages, some of which:

1) It is more secure, as you will not have to do this dangerous escaping before invoking. Parameters are substituted by the DBMS.

2) The DBMS can better understand the "dynamic" part of a query and cache query plans.