sql escapes

closes #54