@MatthiasLohr you don't really need to write a test that uses the db - checking the generated SQL is fine. For escaping, yes, please don't (ever) use string concatenation. If this could work with parameter binding, consider doing it that way.