First, prepend and append a quote to all user input.

• 这里同样有很少的特殊的sql注入规则.