escaping causes problem with sql query