fix unescaped SQL when updating embed code