sanitzes user input and refactors sql query