Role of semi-colon in sql injection and xss attacks
cgi.escape is used to convert text that might contain &, <, and > characters, which generally aren't visible in HTML documents, into HTML entities that will be displayed.  It has nothing whatsoever to do with preventing SQL injection, although it might help prevent XSS attacks by displaying HTML codes as text rather than inserting actual HTML tags into the displayed page.
You should use parameterized queries to avoid SQL injection anyway; escaping input and then building SQL out of it is ugly.
I've been told to use (python's) cgi.escape() function to avoid sql injections and xss attacks, although I'm sure that django automatically escapes variables.  Reading about such attacks, it seems to me that the role of the semi-colon is crucial to both injecting sql and javascript.  Yet, cgi.escape doesn't seem to encode the semi-colon, leaving it bare.  Whilst other less ominous characters get converted into html entities.
Why is this?  Wouldn't encoding ; into something like ≻ conveniently prevent these two common and major forms of attack?
Interestingly, I've been unable to find a html entity for semi-colons.