Sanitize sql query