added quotes to sql statement