sanitize query before running auto complete sql