Ah yeah I don't think osquery has any concept of prepared statements for guarding against SQL injection. Generally anyone issuing osquery queries would be fully trusted to access all of the data in the system.