Category escaping user input sql correctly