Escape string for use in SQL