Quote string in magic filter to avoid SQL injection.
Fix magic filter test.