sql escape literal method added