Consolidate escaping into SqlString

(Formerly: *Fix string escaping for sqlite*)

SQLite was defaulting to the MySQL backslash-escaped style, but it uses postgres-style escaping. This is a SQL-injection vulnerability, and shouldn't be taken lightly (although SQLite is mostly for testing).