+working query builder with very basic security