Sanitize -all- of the params

Bit of a serious bug wherein params that were passed arbitrarily,
GET & POST, etc, were not actually being escaped properly.  There
is a bit of a FIXME here though...I noticed that my param escaping
is dependent upon a DB connection...what if no connection is specified?
That might bring up the idea of some sort of home-baked escape solution.

On the other hand, if we're not persisting any values, (because there is no DB),
then what do we really gain from sanitation in the first place? If that's the
case, then the solution is as simple as turning off that line if there's no
connection configured.