action log quotes in message

public_html/deployment/classes/actionlog.class.php

@@ -82,7 +82,7 @@ class Actionlog {
      */
     private function _makeQuery($sSql) {
         // $this->_log(__FUNCTION__."($sSql)");
-        // echo "<pre>$sSql</pre>";
+        // echo "<pre>".htmlentities($sSql)."</pre>";
         $db = new PDO("sqlite:" . $this->_dbfile);
         $result = $db->query($sSql);
         /*
@@ -113,7 +113,7 @@ class Actionlog {
             '" . $this->_sUser . "',
             '" . $this->_sProject . "',
             '" . $sAction . "',
-            '" . $sMessage . "'
+            '" . str_replace("'", '"', $sMessage) . "'
           );
         ";
         /*