escape all $id used in sql queries