fixing SQL error (' is the string separator, and must be doubled when in the string)