Here is a rather simplistic patch, that just inserts the "date" keyword - this works for Oracle and Postgres,
according to http://sqlzoo.net/howto/source/u.cgi/tip218780/i06dates.xml
this will work for MySQL, but not DB2 or SQL-Server.
As Andrea says. using prepared statements or getting the specialised data store to supply a binding would make more sense.
My preference is for the former, since the geometryless data store I maintain allows plugging in the jdbc driver, so it doesnt necessarily know the underlying database type.
A general solution would need to look into and prepare test cases for all sorts of date and timestamp formats. I guess we should be able to support any ISO date format supplied in the filter for a WFS call.
Do the Cite tests cover any of this? They probably should.