escapeReserved doesn't escape multiple arguments in an expression

escapeReserved function cannot escape sql like below:
UPDATE {users} SET uid=uid - uid WHERE (name = :db_condition_placeholder_0)
It returns UPDATE "USERS" SET "UID"=uid - "UID" WHERE (name = :db_condition_placeholder_0).
It should be UPDATE "USERS" SET "UID"="UID" - "UID" WHERE (name = :db_condition_placeholder_0).

The sql comes from file of "DRUPAL_ROOT./modules/system/system.admin.inc" line 2296 in Drupal 7.12, It excuted when you click "admin/reports/status".

I made some change and works for me:

  private function escapeReserved($query)
  {
        $ddl= !((boolean)preg_match('/^(select|insert|update|delete)/i',$query));
        $search = array ("/({)(\w+)(})/e", // escapes all table names
                         "/({L#)([0-9]+)(})/e", // escapes long id
		                 "/(\:)(uid|session|file|access|mode|comment|desc|size|start|end)/e",
			   	         "/(<uid>|<session>|<file>|<access>|<mode>|<comment>|<desc>|<size>".($ddl?'':'|<date>').")/e",
			   	         '/([\(\.\s,\=])(uid|session|file|access|mode|comment|desc|size'.($ddl?'':'|date').')([,\s\=)])/e',
                         '/([\(\.\s,])(uid|session|file|access|mode|comment|desc|size'.($ddl?'':'|date').')$/e',
        				 '/(\=)(uid)(\s)/e');

	    $replace = array ("'\"\\1'.strtoupper('\\2').'\\3\"'",
				          "'\"\\1'.strtoupper('\\2').'\\3\"'",
				          "'\\1'.'db_'.'\\2'.'\\3'",
					      "strtoupper('\"\\1\"')",
					      "'\\1'.strtoupper('\"\\2\"').'\\3'",
	                      "'\\1'.strtoupper('\"\\2\"')",
	    				  "'\\1'.strtoupper('\"\\2\"')");

        return preg_replace($search, $replace, $query);  	
  }