Update project.class.php

escape ref of project if as ' is typed inside as ref (crazy user)