(#1743) - escape sql in websql's doCompaction

This should be the final SQL injection fix. I don't
see quote() being used anywhere else, except for
static db names.