fix sql vuln

correctly sanitize input in timetracker class
preliminary solution. needs to be ported to prepared queries later.