> I guess my best guess is an off-by-one error in a function trying to escape strings for use in a SQL query,

I don't think it was crashing, but a few years ago I fixed a bug on the app I'm working on, where we had issues with apostrophes in names with SQL Server (where single apostrophes in strings have to be escaped with another one); as it turned out, another dev had written a buggy replace function, the fix was just to use the replace built in the standard lib. I don't think the dev had written a full escaping function, it was just a method to deal with the apostrophes.