add db wrapper for convient operations and kick out sql injection