we should explicitly distinguish the layer here:
* 1. xpath-escaping
* 2. add slashes or some sort of dbconnection->escape
* and 3. some more escaping for fake-sqlite-xpath-functions (?)