Added some basic escaping to sql queries