constraints: escape SQL statements