needs to escape single quotes too