escape mysql query input string in auth