sql_escape is not required here