fixed sql param quoting