Sql.withBatch is not escaping SQL variables

Yes, this is not supported. It is actually a little difficult to do it simply and properly given the underlying Java APIs we have to work with.

The java.sql.Statement class has the executeBatch(String) method and PreparedStatement has an executeBatch() method with no parameters. It means we can execute arbitrary String style queries in a batch or a single prepared statement with many rows in batches but we can't mix different prepared statements in the one batch.

So, the best we could (simply) do is convert such a GString to a normal String. For that we could do a little bit more than we currently do by parsing the String and try to quote or escape "string" looking things but not number or date looking things but it might not be very elegant. Normally we would use the "?" character placeholders and a prepared statement and would have much less to do.

Is there a way to execute parametrized SQL statements in batch mode using Sql, like PreparedStatement's executeBatch()? I couldn't find that in the docs. If Sql does have such a feature then it makes sense to leave withBatch as is.

An off-topic question: Is there a way to find out which parts of a Groovy String contains ${} placeholders or is information regarding those placeholders lost at compile time?

A little late perhaps but a GString does retain (in an implementation specific way) information about the placeholders and the String constants in between those placeholders.