safely (?) escaping sql

proc qname {s} {
    set map [list \" {""}]
    string cat \" [string map $map $s] \"
}

proc qval {s} {
    string cat ' [string map {' ''} $s] '
}

proc insertDict {table dict} {
    set cols [lmap {c _} $dict {qname $c}]
    set cols [join $cols ", "]
    set vals [lmap {_ v} $dict {qval $v}]
    set vals [join $vals ", "]
    set sql "INSERT INTO [qname $table] ($cols) VALUES ($vals)"
}

proc createTable {table cols} {
    set cols [lmap c $cols {qname $c}]
    set cols [join $cols ", "]
    set sql "CREATE TABLE [qname $table] ($cols)"
}


set table {my \"funky table] `name}
set evil {
    {evil \" column} {evil 'value}
    foo bar
}

puts [createTable $table [dict keys $evil]]\;
puts [insertDict $table $evil]\;