always escape double quotes, even for bind vars