quotes needed for sql query