Escape input string to SQL literal.