escaped sql values when building sql strings in the crud functions