Escape % in db+table names before adding to a format string being passed into db.execute()

Fixes #416