escape ' characters for INSERT statements in SQL