change sql to avoid sql injection and to allow ' as part of the study name