using database object for sanitizing - better for unit tests because can be mocked