Bracket and escape rendered permission criteria

A top-level OR in a permission hook no longer lets rows skip the other conditions, and values are escaped before they reach raw SQL.