prevent sql injection. closes #7