The vmPlugin Class (components/com_virtuemart/helpers/vmplugin.php) has a function writeData($_values, $_table) that write data to the inherited plugin's database.
Line 191 to 195 of the version I got (supposed to be latest)
foreach ($_values as $_col => $_val) {
$_cols[] = "`$_col`";
$_vals[] = "'$_val'";
}
$_db = JFactory::getDBO();
This has some issue with string values as they are not escaped, leading to potential problems. Those line should reads :
$_db = JFactory::getDBO();
foreach ($_values as $_col => $_val) {
$_cols[] = "`$_col`";
$_vals[] = "'{$_db->getEscaped($_val)}'";
}
This way, string insertion is safer and causes no more problems.
This function is completly replaced already take a look to the svn.