escape user db inputs