sql update statement with special characters