escape string before insert into DB