Added code to escapre API parameters before using them in queries. Also added some todos.

git-svn-id: http://mantisbt.svn.sourceforge.net/svnroot/mantisbt/trunk@2619 <a class="text" href="/?p=mantisbt.git;a=object;h=f5dc347c">f5dc347c</a>-c33d-0410-90a0-b07cc1902cb9