escape real string

to prevent SQL-injections