Resource preview breaks when CSV headers include percent sign

When a CSV file is uploaded with a percent sign in the headers, attempts to preview it fail with the following error:

File '/usr/lib/ckan/default/lib/python2.7/site-packages/sqlalchemy/engine/default.py', line 331 in do_execute
  cursor.execute(statement, parameters)
IndexError: tuple index out of range

It looks like the percent sign is being interpreted by Python as an attempt to reference a tuple. This breaks previewing, and probably opens the door to an injection attack of some kind.