escape query correctly