trying to escape sql injection