ChatMap: prevent sql injection