escape apostrophe in sql when searching for patient names