That'll need to be escaped and quoted.

git-svn-id: https://samskivert.googlecode.com/svn/trunk@1991 6335cc39-0255-0410-8fd6-9bcaacd3b74c

src/java/com/samskivert/servlet/user/UserRepository.java

@@ -325,7 +325,7 @@ public class UserRepository extends JORARepository
 
         // attempt to update an existing session row, returning true if we found and updated it
         return (update("update sessions set expires = '" + expires + "' " +
-                       "where sessionId = " + sessionKey) == 1);
+                       "where sessionId = " + JDBCUtil.escape(sessionKey)) == 1);
     }
 
     /**