Stop user titles from escaping SQL

Had a submission to this form with apostrophe in the title which escaped SQL and generated an error in the backend.