fix sharing update, add proper escaping

fix for https://github.com/owncloud/core/issues/9863

cc @PVince81 @DeepDiver1975 @LukasReschke @craigpg @karlitschek 
Sorry for being nit-picky here, but is there a reason that we don't use `quote` on `$permission`?