fixed the bug that doesn't escape ' (quotation) in an SQL statement.

This enbuged on commit: 1664e1ed, which moves getColumnValueString()
to the base class: DBAgent. In the fix, sqlite_mprintf() was
replaced our implemented function. The function doesn't have the
feature to escape quoations.