Fix sanitization in sql