title: Escape SQL statement passed to initWithFormat / stringWithFormat
body: <p>I am writing an SQL statement class that will allow a user to create a properly formatted SQL statement string. This class will have a method -(id)initWithFormat:(NSString *)format, ... that needs to work just like the NSString variadic method. The one thing I want to change, however, is any NSString's passed as an argument must be automatically escaped by the initWithFormat.</p>
  
  <p>For example, after initialising a statement like this (notice the string argument has a "'" that needs to be escaped):</p>
  
  <pre><code>MyStatement *statement = [[MyStatement alloc] initWithFormat:@"UPDATE myTable SET myField = %@ WHERE myID = %lu", @"David's Room", 1234];
  </code></pre>
  
  <p>The resulting statement string should be:</p>
  
  <pre><code>@"UPDATE myTable SET myField = "David\'s Room WHERE myID = 1234"
  </code></pre>
  
  <p>Writing the function to escape a string is easy but I can't work out how to include this in the initWithFormat method. Can anyone tell me how to accomplish this? I have thought about emulating the NSString initWithFormat functionality by stepping through each character of the format string, finding any chars starting with % and somehow using a switch statement to append the correct type to a NSMutableString but this seems overly complicated (i.e. some format specifiers are more than 1 char e.g. Signed 16-bit integer %hi and the function should take into account positional specifiers such as %1$@ etc).</p>
  
  <p>All the variadic tutorials I have seen concentrate on nil-terminated lists and don't show how to emulate initWithFormat effectively (including the technical Q&amp;A from Apple that is deceptively titled <a href="http://developer.apple.com/library/mac/#qa/qa1405/_index.html" rel="nofollow">"How can I write a method that takes a variable number of arguments, like NSString's +stringWithFormat:?"</a>).</p>
  
  <p>Thanks in advance.</p>