lol sry @all but try this
Go to char.cpp (serverside)
there u have your "INSERT" Query
// Insert
char szQuery2[512];
snprintf(szQuery2, sizeof(szQuery2), "INSERT INTO %soffline_shop_npc(owner_id, sign, name, time, x, y, z, mapIndex, channel) VALUES(%u, '%s', '%s', %d, %ld, %ld, %ld, %ld, %d)", get_table_postfix(), GetPlayerID(), c_pszSign, GetName(), iTime, GetX(), GetY(), GetZ(), GetMapIndex(), g_bChannel);
DBManager::Instance().DirectQuery(szQuery2);
replace it with:
// Insert
char szSign2[SHOP_SIGN_MAX_LEN+1];
DBManager::instance().EscapeString(szSign2, sizeof(szSign2), c_pszSign, strlen(c_pszSign));
char szQuery2[512];
snprintf(szQuery2, sizeof(szQuery2), "INSERT INTO %soffline_shop_npc(owner_id, sign, name, time, x, y, z, mapIndex, channel) VALUES(%u, '%s', '%s', %d, %ld, %ld, %ld, %ld, %d)", get_table_postfix(), GetPlayerID(), szSign2, GetName(), iTime, GetX(), GetY(), GetZ(), GetMapIndex(), g_bChannel);
DBManager::Instance().DirectQuery(szQuery2);
the "DBManager::instance().EscapeString()" methode should be default in your db.h
So have fun