code: function sanitizeInput(input) {
    // http://www.postgresql.org/docs/9.0/static/sql-syntax-lexical.html [4.1.2.1-4.1.2.2]
    // single quotes (') must be replaced with double single quotes ('')
    input = input.replace(/'/g, "''")
    // backslashes (\) must be replaced with double backslashes (\\)
    input = input.replace(/\\/g, '\\\\')
    // double quotes (") must be replaced with escaped quotes (\\")
    input = input.replace(/"/g, '\\"')
    return input
  }
docs: https://github.com/scarney81/pg-hstore