escaping of character: ' in prepared statement values