Escape SQL parameter in Profile_tag::moveTag()
Escape SQL parameter in Profile_tag::moveTag()

This change adds additional escapes for arguments to
Profile_tag::moveTag(). The arguments are canonicalized in the API and
Web UI paths higher up the stack, but this change makes sure that no
other paths can introduce SQL injection errors.

csarven/statusnet,zcopley/StatusNet,faulteh/gnu-social,charnimda/lgbtpzn-social,gnusocial/mainline,csarven/statusnet,Piratas/tortuga,eXcomm/gnu-social,foocorp/gnu-social,sikevux/bsk-social,eXcomm/gnu-social,furtherfield/gnu-social,sikevux/bsk-social,bankonme/gnu-social,studio666/gnu-social,csarven/statusnet,gnusocial/mainline,eXcomm/gnu-social,faulteh/gnu-social,faulteh/gnu-social,gnusocial/mainline,studio666/gnu-social,furtherfield/gnu-social,faulteh/gnu-social,chimo/social,bankonme/gnu-social,zcopley/StatusNet,foocorp/gnu-social,charnimda/lgbtpzn-social,foocorp/gnu-social,gnusocial/mainline,Piratas/tortuga,Piratas/tortuga,charnimda/lgbtpzn-social,furtherfield/gnu-social,chimo/social,bankonme/gnu-social,charlycoste/StatusNet,furtherfield/gnu-social,sikevux/bsk-social,zcopley/StatusNet,charlycoste/StatusNet,chimo/social,studio666/gnu-social,bankonme/gnu-social,csarven/statusnet,studio666/gnu-social,sikevux/bsk-social,Piratas/tortuga,eXcomm/gnu-social,charlycoste/StatusNet