Server: escape variables in SQL query (fixes #123)