various fixes to queries being badly sanitized