database updates, escape chars