Parameterized queries for raw SQL

[eulerbutcooler]

Problem

Four knex.raw() calls use JS template literal interpolation to embed values directly into SQL query strings which is not the standard way of doing a knex.raw() query.

• src/server/helpers/collections.js - getCollectionItems() interpolates collectionId, size, and from
• src/server/helpers/achievement.js - processSprinter() interpolates editorID, getConsecutiveDaysWithEdits() interpolates editorID and days
• src/server/routes/editor.tsx - getProgress() interpolates editorID

All though none of these queries are prone to SQL injectioning as all values either come from an authenticated session or are validated/hardcoded it would still be a decent code improvement.

Solution

Replace all string interpolation in knex.raw() with parameterized placeholders(?) and value arrays.

• I have run the code and manually tested the changes

AI usage

• I did not use any AI
• I have used AI in this PR (add more details below)