[SECURITY-173] Escape values in SQL queries