More fixes for untrusted values in SQL.

Addresses #18, but not done yet...