this is "the ugly" part of Java's JDBC driver. As I said in the pull request, since JDBC doesn't define a way to escape its values, rather than using prepared statements, I needed to do a little name mangling there. It's working, but this means that you won't be able to cache a SQL statement, as the 'escapes' array is cleared every time 'request' is called.
For the time being, I guess it's the most secure way to deal with that. Also by using the 'id' field, which is guaranteed to be unique for a request, it will eagerly fail if a statement is cached - this way we avoid hard-to-find bugs derived from this.