Escape username in SQL statements

Unescaped versions cause syntax errors when username contains a dash