Form: get_history sql escaping