deep version of 'escape for sql', you may also call it 'correct-er'