Use sql escape for vars in the sql statements