escaping strings in pure sqlite