Comment by rowborg

That was also my first thought (injection all the way down), but doesn't this reduce the problem to enforcing simple character escaping?