corrected mistake with escaping sql statements