prevented sql injection

replaced ' with ''