Observed problem:
If you specify the 'encoding' attribute of the <sql> task, you would expect that the task fails when some illegal characters are passed as input. Current behavior is to replace them with U+FFFD REPLACEMENT CHARACTER, which is useless in the database world.

Background:
Stackoverflow question: http://stackoverflow.com/questions/4886460/why-does-us-ascii-encoding-accept-non-us-ascii-characters

Suggested solution: 
When encoding is specified, explicitly specify 'CharsetDecoder' with CodingErrorAction.REPORT as the input to InputStreamReader instead of simple encoding.

Semi-patch:
reader = (encoding == null) ? new InputStreamReader(is) : new InputStreamReader(is, encoding);

could be replaced with:

if (encoding == null) {
   reader = new InputStreamReader(is);
} else {
   CharsetDecoder decoder = Charset.forName(encoding).newDecoder();
   decoder.onMalformedInput(CodingErrorAction.REPORT);
   reader = new InputStreamReader(bais, decoder);  
}