Escape strings before use in SQL query, clean up, use sprintf