I have considered that but opted not to, as this depends on how create_and_switch_db is used elsewhere. It also makes more sense that create_and_switch_db accepts real passwords as parameters and so I made the assumption that that is the case.

If the unescape should go inside create_and_switch_db, then we need to also make a note in the function comments that passwords must always be escaped before being passed to create_and_switch_db.