Update stats.py

Correctly escaped for names like "O'Reilly" for sqlite.  Testing latest changes then moving on testing for Postgres, then MySQL.  Then I'll move on to events.py.