Ok, looks like a bug in the mod in that it's not calling addslashes on the username.