or, alternatively, always treat your database roles as though they can be directly manipulated by the end user, and you'll eliminate an entire class of injection vulnerabilities.

my favorite example of this is SchemaVerse, a game fully implemented in pgsql.

https://schemaverse.com/