quote params in sql statements