=== trac/db/sqlite_backend.py
==================================================================
--- trac/db/sqlite_backend.py	(revision 8584)
+++ trac/db/sqlite_backend.py	(local)
@@ -21,6 +21,10 @@
 from trac.db.api import IDatabaseConnector
 from trac.db.util import ConnectionWrapper
 
+def escape_percent(sql):
+    import re
+    return re.sub("'((?:[^']|(?:''))*)'", lambda m: m.group(0).replace('%', '%%'), sql)
+
 try:
     import pysqlite2.dbapi2 as sqlite
     have_pysqlite = 2
@@ -34,12 +38,12 @@
                 raise
         def execute(self, sql, args=None):
             if args:
-                sql = sql % (('?',) * len(args))
+                sql = escape_percent(sql) % (('?',) * len(args))
             return self._rollback_on_error(sqlite.Cursor.execute, sql,
                                            args or [])
         def executemany(self, sql, args=None):
             if args:
-                sql = sql % (('?',) * len(args[0]))
+                sql = escape_percent(sql) % (('?',) * len(args[0]))
             return self._rollback_on_error(sqlite.Cursor.executemany, sql,
                                            args or [])
         def _convert_row(self, row):
@@ -61,6 +65,20 @@
     try:
         import sqlite
         have_pysqlite = 1
+
+        class EscapeCursor(sqlite.Cursor):
+
+            def execute(self, sql, args=None):
+                # use [] instead of calling "execute" without args to make sure
+                # the '%%' escapes are converted back to a single '%'
+                return sqlite.Cursor.execute(self, escape_percent(sql),
+                                             args or [])
+
+            def executemany(self, sql, args=None):
+                # see note regarding args for "execute"
+                return sqlite.Cursor.executemany(self, escape_percent(sql),
+                                                 args or [])
+
     except ImportError:
         have_pysqlite = 0
 
=== trac/ticket/report.py
==================================================================
--- trac/ticket/report.py	(revision 8584)
+++ trac/ticket/report.py	(local)
@@ -448,18 +448,29 @@
 
     def sql_sub_vars(self, req, sql, args):
         values = []
-        def repl(match):
-            aname = match.group(1)
+        def add_value(aname):
             try:
                 arg = args[aname]
             except KeyError:
                 raise util.TracError("Dynamic variable '$%s' not defined." % aname)
             req.hdf['report.var.' + aname] = arg
             values.append(arg)
+
+        def repl(match):
+            add_value(match.group(1))
             return '%s'
 
-        return re.sub("'?\$([A-Z]+)'?", repl, sql), values
+        def repl_literal(match):
+            add_value(match.group(1))
+            return "' || %s || '" # break literal string & concatenate with arg
 
+        var_re = re.compile("[$]([A-Z]+)")
+        sql = [var_re.sub(s.startswith("'") and repl_literal or repl, s)
+               for s in re.split("('(?:[^']|(?:''))*')", sql)]
+        sql = ''.join(sql)
+        self.log.debug(sql)
+        return sql, values
+
     def _render_csv(self, req, cols, rows, sep=','):
         req.send_response(200)
         req.send_header('Content-Type', 'text/plain;charset=utf-8')