sqlite3 syntax errors with some names

[th3-z]

Line 68 of database.py causes a syntax error if the player name contains quotes.

[th3-z]

To fix this issue all uses of string.format() in database.py's queries needs to be replaced with a parameterized cur.execute(query, (p1,p2))
good:
self.cur.execute("UPDATE players SET dosh = ? WHERE username = ?",\ (player.total_dosh, player.username))
bad:
self.cur.execute('SELECT (health_lost) FROM players WHERE username="{un}"'.\ format(un=username))

[th3-z]

Solved by commit d855d67