Insecure

[dsd]

wikiserver commit 6ea1a1c78131 adds some custom string handling. This probably works in the " case but isn't great.

You should properly escape the string passed to the query. See the "# Never do this -- insecure!" example at  http://docs.python.org/library/sqlite3.html