Yeah, this is a bit unusual. The magic is that $conn is an AphrontIsolatedDatabaseConnection ("Isolated"), not a normal AphrontMySQLiDatabaseConnection.php ("MySQLi"). "Isolated" is the default type of connection when running in unit tests, unless you opt the test into a real database connection.

Since an isolated database connection doesn't actually connect to any kind of database server, it never needs to actually build a real query string. We just implement all the escape functions in a trivial way to make unit testing and some aspects of connection/query isolation easier -- and the escaping itself, since we don't have a real $conn and thus can't call mysql_real_escape_string($string, $conn) to get real escaping. We could fake it with ad-hoc addcslashes()-based escaping or something, but since we don't actually need to escape things and nothing will ever evaluate these queries, these trivial implementations are sufficient:

...

  public function escapeUTF8String($string) {
    return '<S>';
  }

  public function escapeBinaryString($string) {
    return '<B>';
  }

  public function escapeColumnName($name) {
    return '<C>';
  }

  public function escapeMultilineComment($comment) {
    return '<K>';
  }

  public function escapeStringForLikeClause($value) {
    return '<L>';
  }

...

So qsprintf(<IsolatedConn>, ...) really is returning literally <S> and <C> and such, and assertEqual() is doing normal check (that the strings are exactly identical).