fixed sanitized sql