Escaping arguments passed to MySQL