escape input

it escaped all query but fixed and now it escapes inputs only