SECURITY: Escape field value for SQL