sanitize parsed elements: remove any ' as it won't play well with sql