Use sqlite's '%q' format specifier

This replaces all instances of '%s' with '%q' in the SQL command
formatter.  Effectively this provides escaping for free!
Insert correct values into MH__messages

Now that I've parsed everything I can go ahead and actually stick the
correct values inside the SQL table that caches these sorts of things.
This allows me to write "scan", which shows the current folder.