Instead of s/\'/\'\'/g, would not it be s/\'/\\\'/g ?

If you think it is best in SetUserSettings, go for it. But, then, you should add it in most Set*Settings for consistency.

It's not really at the DBI level:
sub SetUserSettings {
SetDBSettings("user", "user_name='$_[0]'", "$_[1]='$_[2]'");
}

if arg0 or arg2 contains a quote, then there will be a quote mismatch.

As far as I see, we just need to add s/\'/\'\'/g in SetUserSettings-like procedures. That's how it's done in sv_skills, despite sv_skills directly uses the 'mysql' command.

Aie aie sir.

There is a small issue to discuss: at a point I have to escape an argument that I pass to SetUserSettings, so that if the key contains a <<'>>, it doesn't make the SQL query fail.

I think this test should be moved in SetUserSettings itself.

Is it ok?

The script was applied to the Savannah database. We haven't received complaints yet.

Here's the script, feel free to edit.