better query sanitization