escape table names in queries