ensure backslashes in SQL string values are escaped