escape quotes in a string