update sql1.md to remind about escaping

Add escaping reminder