escape sql on post title query