use connection.escape() for mysql, problem solved