quote table alias

because var could contain otherwise illegal characters for a sql alias