make sure statement is properly escaped