This provides a sort of poor man's SQL escaping to prevent injection
attacks. Note that the latitude and longitude column names are not
escaped, but those values should be coming from app configuration and
hence should be safe.