fixed escape string bug, updated query