Note: I'm pretty sure this was a bug covered by a bogus test previously: the correct escaping in sqlite is '', not \'