[raghu45345]

1. database_exists interpolates the database name from the URL into a single-quoted SQL literal in the postgresql, mysql and mssql branches, so the URL from SQL Injection in database.py database_exists #760 (postgresql://user:pass@localhost/test'; CREATE TABLE hello (id int); COMMIT; SELECT 1 FROM pg_database;--) runs the injected statements on the server while the function returns False.
2. The name is now passed as a bound parameter via sa.text(...).bindparams(database=database) in all three branches, and each dialect test class gained a regression test using an OR-based database name that made the old query match an existing database.

Fixes #760.