sql injection protection, replacing quotes