move DBH.sqlEscape to sanitize.escape