are these strings expected to be pre-sanitized for sql injection? I'm not that familiar with the finagle mysql client but I'd actually feel a little more at ease if it were using prepared statements.