escape sql queries properly
add analytics code