-                       /*
-                        * TODO: We really want to use PQescapeString, but this
-                        * isn't supported by the version of Postgresql in
-                        * Debian Stable. Roll on Woody and for now kludge it.
-                        */
-                       dodgychar = strchr(uids[i], '\'');
-                       while (dodgychar != NULL) {
-                               *dodgychar = ' ';
-                               dodgychar = strchr(uids[i], '\'');
+                       safeuid = malloc(strlen(uids[i]) * 2 + 1);
+                       if (safeuid != NULL) {
+                               memset(safeuid, 0, strlen(uids[i]) * 2 + 1);
+                               PQescapeString(safeuid, uids[i],
+                                               strlen(uids[i]));
+
+                               snprintf(statement, 1023,
+                                       "INSERT INTO onak_uids "
+                                       "(keyid, uid, pri) "
+                                       "VALUES ('%llX', '%s', '%c')",
+                                       get_keyid(publickey),
+                                       safeuid,
+                                       (uids[i] == primary) ? 't' : 'f');
+                               result = PQexec(dbconn, statement);
+
+                               free(safeuid);
+                               safeuid = NULL;