fixing quotes to prevent varnames from getting through to db.