refactoring: use escapeSQL() everywhere