escape arguments to SQL queries