SQL functions are not escaped