escape custom field columns properly

this allows custom field values like "foo-bar", i.e not to create
substraction expression.