bug fix: forgot to escape sql input when doing select statement