esquaped that sql mmhm

also changed it so it didn't throw a echo of the sql