Bingo! There’s your problem.
The function “attribute_escape()” in in the file “media.php” treats the string “Insert into” as attempt to insert an SQL command into the db.
The solution is simply to change the wording from “Insert into” to something else that doesn’t mimic an SQL command.
Nice find jamused!
I think this will also solve or avoid having to .htaccess out the security mod.