Added sql sanitization

Added escapes to items grabbed from sql array.