adding SQL string escaping to the token before its merged with the query