[db] Fix an injection issue in update

There's still plenty of potential for problems with this. Stuff like
this is why #194 needs to happen. Related to #645.