given our historical and ongoing pain here, maybe we need to write correct, algorithmic string escaping routines and carefully use them exactly where required...