added sql escape