added sql escape function