No, you're not missing anything. The addon code just can't handle using apostrophes, which suggests it may also be vulnerable to SQL injection attempts.