missing escape in isql rule sanitize