sql escape
Merge pull request #1034 from john-hill/PLFM-2377

sql escape