String quoting for SQL queries