The sql sanitizer returned the last token as the whole statement. That was
dumb.