sql variable validation function

update to escape % and underscore signs