escape single quote (')