SQL injection vulnerability.

Filenames are not being escaped, and may contain apostrophes, thereby corrupting the queries.