diff --git a/includes/database.mysql-common.inc b/includes/database.mysql-common.inc
index e3e0d85..244182c 100644
--- a/includes/database.mysql-common.inc
+++ b/includes/database.mysql-common.inc
@@ -33,6 +33,12 @@ function db_query($query) {
   $args = func_get_args();
   array_shift($args);
   $query = db_prefix_tables($query);
+
+  // MC: 28/9/11: added to support escaped string constants in defaults.
+  // shouldn't affect any other normal queries since string constants
+  // are in the arguments `$args` to the query, and are substituted in below.
+  $query = stripcslashes($query);
+
   if (isset($args[0]) and is_array($args[0])) { // 'All arguments in one array' syntax
     $args = $args[0];
   }
@@ -185,7 +191,8 @@ function _db_create_field_sql($name, $spec) {
 
   if (isset($spec['default'])) {
     if (is_string($spec['default'])) {
-      $spec['default'] = "'". $spec['default'] ."'";
+      $escaped_default = addcslashes(strtr($spec['default'], array('{' => "\\x7b", '}' => "\\x7d")), "");
+      $spec['default'] = "'". $escaped_default ."'";
     }
     $sql .= ' DEFAULT '. $spec['default'];
   }
@@ -303,6 +310,7 @@ function db_add_field(&$ret, $table, $field, $spec, $keys_new = array()) {
   if (count($keys_new)) {
     $query .= ', ADD '. implode(', ADD ', _db_create_keys_sql($keys_new));
   }
+  debuglog("db_add_field, query = '$query'\n");
   $ret[] = update_sql($query);
   if (isset($spec['initial'])) {
     // All this because update_sql does not support %-placeholders.