[gr8man]

Description
SQLSRV\Builder::_upsertBatch() concatenated the table name string directly into Object_ID('" . $table . "') without escaping, resulting in syntax errors on table names with quotes or special characters. It now properly escapes the table name using $this->db->escape($table).

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide