escaping single quotes for security?