lots of work to try and get the add_meeting page working.

it all appears to be working now, except if you have a field
an unescapted ' (single quote) in it. There is a whole tl;dr
section below on it.

However, I've just written database.select2() to start to fix
it, but wanted to record the state of all the other code before
I got mucking with it.

================================================================

problem 1

	my sqls are going in as fully formatted strings:
	sql = "insert into s='dsfjsdfsf'
	but the 'sdfsadfs' could have an unescaped ' in it, which fucks things up.

solution 1

	pass the variables for substitution into the sql stmt to the db method
	seperately. if we do this, then they will get properly escaped on
	query execution.

		sql = "insert into s=%s'
		var = "sdfadfsf'"

		db.insert(sql, var)

	potential gotcha:
		what if we are passing multiple variables, like we usually
		are?

			sql = "insert into X s=%s and y=%s and z=%s"
			var1 = "sfsafd"
			var2 = "ewrwer"
			var3 = "mmmm"

			db.insert(sql, var1, var2, var3)

		in the above scenario, the db.insert() method gets nasty, because we have to
		code each method (eg insert, select, delete and update) to be overloaded with
		an almost infinite number of variables, which is shit.

	solution to potential gotcha:

		option 1:

			try putting all the vars to be substituted into an array and pass the array
			instead

				sql = "insert into X s=%s and y=%s and z=%s"
				sql_vars[0] = "sfsafd"
				sql_vars[1] = "ewrwer"
				sql_vars[2] = "mmmm"

				db.insert(sql, sql_vars)

			we *think* we can then execute this inside our database module like:

				cursor.execute(sql, sql_vars)

			but, we're not sure, maybe will need to write some test code to validate it.

			Pros:
			* seems like the right answer, if it works (OK, it works).
			Cons:
			* reasonable amount of coding (stop moaning, and just fucking do it).

		option 2:

			we could import MySQLdb into every script where a var is passed to an SQL stmt
			and use MySQLdb.escape_string() on anything before it's substitued in?

				sql = "insert into X s=%s and y=%s and z=%s" % (MySQLdb.escape_string(self.var1),
															    MySQLdb.escape_string(self.var2),
															    MySQLdb.escape_string(self.var3))

			Pros:
			* potentially the least amount of coding.
			Cons:
			* seems shitty to be importing MySQLdb when I wrote a module to abstract it away.

		option 3:

			there is some talk that if we switch from ''' to """ or vice vera, that it will all work
			without needed to do anything.

			old:
				sql = """insert into s='%s' """

			new
				sql = '''insert into s="%s" '''

			Pros:
			* simplest of all
			Cons:
			* not sure if it works or will continue to work.
			* prolly only saves us from rogue (')s, what about
              if I have a (") in a stmt?