update core query as SQL friendly (installation)

all due to Oracle and DB2 extra handling. they will use preg_replace_callbacl() to filter out all database specific reserved words and escape them, only if they are in lower case. for letting this functioning, we need to follow drupal's query coding standard strictly:

1. write all query elements (reserved word) into upper case, so will not catch by preg_replace_callback()
2. put all user input value into %s/%d/%f/%%/%b, so they will also not catch by preg_replace_callback(), too

on the other hand, as different database come with different string escape handling (db_escape_string()), putting all values into %s can ensure codes are able to function among different database :)

P.S. the main idea is: just follow our query coding standard for "ALL" queries, therefore all new database drivers will able to function with no question. they will handling their database specific reserved words internally :)

i guess this patch just try to promote our coding standard (http://drupal.org/node/2497), which is VERY useful for other database implementation. on the other hand, this can improve our codes quality (we promote our coding standard, so at least we follow it, too). we grain something with no trade-off :)

so let's take system.install as example:

<?php
-  db_query("INSERT INTO {variable} (name,value) VALUES('theme_default', 's:7:\"garland\";')");
+  db_query("INSERT INTO {variable} (name, value) VALUES ('%s', '%s')", 'theme_default', 's:7:"garland";');
?>
here we are assuming all databases use <code>\

as escape character: for Oracle and DB2, we only need to escape ', which replace it as ''. if we are not placing string value into %s, it may be a bit difficult to ensure cross database compatibility. it is a hidden bug that may be happened, but can escape by following our coding standard :)

sorry about this example, it is only a escape for starting "... BTW, it is still a good idea to use our db_query() correctly :)

since both Oracle/DB2/MSSQL will preform A LOT OF reserved word rewrite handling to query BODY, this patch can greatly improve the ability of cross database compatibility. This is because all user input values are escaped, and will not capture by rewrite handling.

document the changes in following book pages:

1. update document: http://drupal.org/node/114774#db-query-standard
2. coding style document: http://drupal.org/node/2497

thanks chx :)