SQL injection vulnerability.

Filenames are not being escaped, and may contain apostrophes, thereby corrupting the queries.
SQL Injection issue

Filenames are not being escaped, and may contain apostrophes, thereby corrupting the queries.
Escape file names in SQL query.
Merge pull request #210 from bhoipkemier/v160

SQL escaping problem if admin uploads filenames containing apostrophes