Escaping user input for inserts and updates

You never know what users will input. Better stay on the safe side here.