properly escape query string before passing to sqlite3