removed sql escape