Wrap sql_query in CDATA tag for safely posting XML.
Fix ShapeFile instance creation.