Use new postgres escape function everywhere

[fm3]

We have a basic escape function in place for strings passed to sql queries where they are not prepared statements. However, PR #6416 introduces a new one, which can handle more cases. It should be used everywhere (check carefully that no literals break, though)