Fix string escaping for sqlite

SQLite was defaulting to the MySQL backslash-escaped style, but it uses
postgres-style escaping. This is a SQL-injection vulnerability, and
shouldn't be taken lightly (although SQLite is mostly for testing).

lib/sql-string.js

@@ -37,8 +37,9 @@ SqlString.escape = function(val, stringifyObjects, timeZone, dialect) {
     }
   }
 
-  if (dialect == "postgres") {
+  if (dialect === "postgres" || dialect === "sqlite") {
     // http://www.postgresql.org/docs/8.2/static/sql-syntax-lexical.html#SQL-SYNTAX-STRINGS
+    // http://stackoverflow.com/q/603572/130598
     val = val.replace(/'/g, "''");
   } else {
     val = val.replace(/[\0\n\r\b\t\\\'\"\x1a]/g, function(s) {