update sql1.md to remind about escaping