sqlstring comma and quotation