changed db-install target to use a config file rather than passing the db password as command line option when invoking the "mysql" client. added basic output escaping for properties in SQL commands in the "setup-zero-user" target.