Quote every string given by the form for SQL