Role of semi-colon in sql injection and xss attacks
Semicolons are sometimes an issue when putting values into SQL, but are not an issue when putting values into HTML.
cgi.escape() is designed for escaping things that are being put into HTML, and thus only escapes things that are an issue in HTML.
I've been told to use (python's) cgi.escape() function to avoid sql injections and xss attacks, although I'm sure that django automatically escapes variables.  Reading about such attacks, it seems to me that the role of the semi-colon is crucial to both injecting sql and javascript.  Yet, cgi.escape doesn't seem to encode the semi-colon, leaving it bare.  Whilst other less ominous characters get converted into html entities.
Why is this?  Wouldn't encoding ; into something like ≻ conveniently prevent these two common and major forms of attack?
Interestingly, I've been unable to find a html entity for semi-colons.