SQL string escape on push