modified code to escape characters that affect SQL statement syntax