Escape the input string in SQL statement