fix string quoting for query parameterization