Unable to change weight, description (SQL syntax error); filename, description should be escaped

(1) Unable to change weight, description, I've gotten a SQL syntax error (with PostgreSQL).

WRONG: UPDATE node_images SET description=".....", weight=... WHERE ....
CORRECT: UPDATE node_images SET description='.....', weight=... WHERE ....

(string literal should be enclosed with single quotes according to SQL92 standard syntax, and PostgreSQL doesn't accept string literal enclosed with double quotes. MySQL accepts string literal enclosed with double quotes if ANSI_QUOTES SQL mode is disabled).

(2) filename, description may contain quote characters, so that they had better escaped with db_escape_string().