Bug 848082: Properly escape parameters for mysql. r=bhearsum