I've checked in a patch to weblog/search.hac that escapes single quotes in search strings. This may or may not have been a security problem (if it was, I wasn't able to exloit it). Anyway, antville.org is running the updated code now. This is a temporary patch since I'm currently rewriting the search function to be more flexible, including the capability to search the whole site/server instead of just one weblog.