Clear passwords in the database, nice. Sounds like a post for OracleWTF...

maybe because you're passing an extra '"' at the end of the call to create_user?