[v9.1] fix (MySQL escape): make a special case of RAND()

[chaen]

@sfayer maybe there's a better way ?

BEGINRELEASENOTES
*WMS
FIX: MySQL does not escape RAND() as an order attribute

ENDRELEASENOTES

[sfayer]

This seems fine to me: I think ideally I'd like to generalise the _quotedList allowDate parameter to be something like allowFuncs with a list of function names that are allowed. If this one is merged to fix the immediate problem, I'll look at how feasible it is to make a more generic fix in the very near future (likely later this afternoon). I doubt we can do much better than that: There isn't any other way to know which functions are safe for any context without them being explicitly listed.

I'll try to add some test cases for the database problems that have been found recently too so we can avoid any potential future regressions.