sanitised sql of comments