fix escape sql injection