Upgrade to properly escape strings sent to a db query