We're taking `where` from user input and feeding it straight into the database. Should we be sanitizing it first? Like is it possible to do something disastrous by including the GQL equivalent of "; DROP TABLE LanternUser" in it? Not very experienced with this so apologies if it's not a concern!