use secure db queries