escape string before using in sql