SQL injection fix.

Google sanitizing sql input. Almost every single article explains why you should never attempt to roll your own function to do this.

I have confirmed there is at least one case the old version doesn't account for, but I don't plan to go into details here. Trusted people have been briefed, please talk to me

I tested this and things work fine.