avoid SQL injections while bulk insert