Adding quotes around SQL variables