Escaping single quotes.

Some db queries contained parameters which were not properly escaped.
Fixed.