Avoiding (all?)sql injection during login by escaping special char