src/main/java/com/conveyal/gtfs/loader/JdbcGtfsLoader.java
public static String sanitize (String string, SQLErrorStorage errorStorage) {
        String clean = string.replaceAll("[^\\p{Alnum}_]", "");
        if (!clean.equals(string)) {
            LOG.warn("SQL identifier '{}' was sanitized to '{}'", string, clean);
            if (errorStorage != null) errorStorage.storeError(NewGTFSError.forFeed(COLUMN_NAME_UNSAFE, string));
        }
        return clean;
    }
public static String sanitize (String string, SQLErrorStorage errorStorage) {
        String clean = string.replaceAll("[^\\p{Alnum}_]", "");
        if (!clean.equals(string)) {
            LOG.warn("SQL identifier '{}' was sanitized to '{}'", string, clean);
            if (errorStorage != null) errorStorage.storeError(NewGTFSError.forFeed(COLUMN_NAME_UNSAFE, string));
        }
        return clean;
    }
Protect against SQL injection.
The only place we include arbitrary input in SQL is the column names of tables.
Implicitly (looking at all existing table names) these should consist entirely of
lowercase letters and underscores.

TODO add a test including SQL injection text (quote and semicolon)