Patient.doctor_id is not escaped