create query with callback (allows proper escaping)
reject promise when query returns false