escape any quotes in the string