fix sql quote escaping