modified update function

encodes " and ' symbols so that they don't mess up the sql query