sanitizing the whole query produces broken queries. this method is definitely dangerous, but necessary for now