changed var name from string to str in DAO escape()