escape column names for INSERT statements