sanitizes string input for json query