escape js/sql strings
disable the country/province sorting for now, buggy