Escape string for mysql query