Properly escape queries