Escape values in SQL queries