escape user input string

fixed escaping all query to escape strings which are input by users.