SQL escaping problem if admin uploads filenames containing apostrophes

Filenames are not being escaped, and may contain apostrophes, thereby corrupting the queries.